Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AI Bikini Photo Editor-AI Editor for Swimwear & Bikini Photos – CLI-powered
v1.0.0AI bikini photo editor — edit a person photo into a bikini scene with a required prompt
⭐ 0· 59·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill name and description align with the declared dependency on the WeShop CLI and the single WESHOP_API_KEY environment variable — those are proportionate to an image-editing API. However the SKILL.md references multiple domains (www.weshop.ai, openapi.weshop.ai, open.weshop.ai) and the registry metadata has no homepage or verifiable publisher; this reduces confidence in provenance.
Instruction Scope
Runtime instructions are limited to using the weshop CLI and reading WESHOP_API_KEY, which is expected. But the default prompt explicitly instructs removing clothing from a person’s photo ('naturally undress'), which enables creation of sexualized images of real people. The skill gives no guidance to ensure consent or legality and could be used for non-consensual or abusive deepfakes.
Install Mechanism
This is an instruction-only skill with no install spec or code files, lowering filesystem risk. The README instructs installing an npm package (weshop-cli) manually — that's normal, but the skill provides no verification of the CLI's authenticity or its npm/GitHub metadata.
Credentials
Only a single API credential (WESHOP_API_KEY) is required and declared as the primary credential; this is proportionate to calling a third-party image-editing service. The SKILL.md warns not to pass the key on the CLI and to only send it to openapi.weshop.ai, but those claims cannot be independently verified from the skill itself.
Persistence & Privilege
The skill is not set to always:true and does not request persistent system privileges or other skills' credentials. It is user-invocable and can be invoked autonomously as normal for skills, which is not itself a red flag here.
What to consider before installing
Before installing: verify the WeShop service and the weshop-cli package (check the npm page and GitHub repo and confirm the domains match and are legitimate). Do not share your API key except via the environment variable and avoid pasting it into prompts. Be aware this skill's default prompt encourages removing clothing from real people — only use it with explicit, documented consent and in jurisdictions where such image editing is lawful. If you need higher assurance, request the skill author to provide a homepage/source repo, or review the weshop-cli source code yourself in a sandboxed environment. Consider restricting the API key's scope and rotating it if you test the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9791p1rf6s234gcbsbwhnnbyx84j03b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvWESHOP_API_KEY
Primary envWESHOP_API_KEY