Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ganesh API

v1.0.0

Ganesh Image Hosting API for image hosting. Use when user mentions "Ganesh", "upload image", "image hosting", or asks about image sharing.

0· 114·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for davidbergman121/ganesh-api.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ganesh API" (davidbergman121/ganesh-api) from ClawHub.
Skill page: https://clawhub.ai/davidbergman121/ganesh-api
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ganesh-api

ClawHub CLI

Package manager switcher

npx clawhub@latest install ganesh-api
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description and SKILL.md consistently describe an image-hosting API for uploading images. However, the SKILL.md references a 'Client ID' as required for the API while the skill metadata declares no required environment variables or primary credential and has no homepage or known source. That mismatch is unexpected: a skill that needs an API key should normally declare it.
Instruction Scope
The instructions are minimal and stay within the stated purpose (upload images and get shareable URLs). They do not instruct reading arbitrary system files or accessing unrelated credentials. However, they defer important details (how to obtain/use the Client ID, exact upload endpoints, and request flow) to an external docs link, which transfers trust to that external URL.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer, which is the lowest-risk install posture.
!
Credentials
SKILL.md mentions a Client ID but the skill declares no required environment variables or primary credential. This inconsistency is a red flag: a skill that requires credentials should declare them so the platform and user can manage secrets appropriately. Also the external docs URL is an obscure short domain (ishortn.ink), which could redirect to unexpected endpoints — relying on that domain to obtain API details increases risk.
Persistence & Privilege
The skill does not request always:true, does not declare modifications to other skills or system config, and uses platform-default autonomous invocation — nothing unusual in persistence or privilege.
What to consider before installing
This skill claims to integrate with an image-hosting API and is instruction-only, but it references a Client ID without declaring any required credential and points to a short/obscure docs URL. Before installing or using it: 1) Verify the vendor/source (ask where 'Ganesh' comes from or prefer a skill with a known homepage). 2) Do not paste your production API keys or secrets into the chat; prefer platform-managed environment variables if the skill truly needs them. 3) Inspect the documentation URL in a safe environment (expand short links) to confirm it goes to an official API page. 4) If you must test, use a throwaway account or temporary credentials. If the skill will be used automatically by an agent, consider the risk that the agent could send image data or tokens to the external domain — only proceed if you trust the service and the documentation domain.

Like a lobster shell, security has layers — review code before you run it.

latestvk9760n0sh5q0wf6sc096jc4dad854q7z
114downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Ganesh Image Hosting

Ganesh is a free image hosting service. Upload images and get URLs for sharing, embedding in articles, or using in documentation.

When to Use

  • Upload images to get shareable URLs
  • Host images for blog posts or documentation
  • Get image URLs for use in Markdown content
  • Anonymous image uploads (no account needed)

API Reference

Once you have your Client ID, you can use the Ganesh API to upload images. The full documentation is available at https://ishortn.ink/ganesh-official-api , and changes frequently, so refer to the official docs for the latest endpoints and parameters.

Comments

Loading comments...