cli-anything-gimp

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent GIMP image-editing CLI skill, with the main caveat that it relies on an undeclared local CLI environment and setup commands the user should verify.

This skill appears safe for its stated purpose of controlling GIMP through a CLI. Before installing or using it, confirm that the referenced cli-anything-gimp command, virtual environment, and local CLI-Anything checkout are trusted, and review file paths when opening or exporting images.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may open, modify, and export image/project files through the GIMP CLI workflow.

Why it was flagged

The skill grants the agent access to a local CLI tool through Bash. This is expected for a CLI-based GIMP skill, but users should recognize that the tool can perform image-editing and file-output operations.

Skill content

allowed-tools: Bash(cli-anything-gimp:*)

Recommendation

Use the skill on files you intend to edit and review output paths before accepting generated commands.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the local CLI-Anything checkout or Python environment is not trusted, the skill could rely on unreviewed local code.

Why it was flagged

The skill documents setup using Python packages and an editable local CLI-Anything checkout, but the registry metadata lists no install spec or required binaries. This is purpose-aligned but leaves provenance and setup state for the user to verify.

Skill content

pip install click numpy Pillow prompt-toolkit
cd ~/.openclaw/workspace/CLI-Anything/gimp/agent-harness
pip install -e .

Recommendation

Verify the local CLI-Anything source directory and installed Python packages before using the skill.