AI Xray Clothes – Free AI Clothes Replacer Tool – API-powered
AdvisoryAudited by VirusTotal on Apr 14, 2026.
Overview
Type: OpenClaw Skill Name: ai-xray-clothes-openapi-skill Version: 1.0.0 The skill provides instructions for an 'AI x-ray' service designed to make clothing appear see-through via the `openapi.weshop.ai` domain. While the SKILL.md file includes standard API integration logic and explicit security warnings regarding the handling of the `WESHOP_API_KEY`, the service's stated purpose is inherently high-risk and frequently associated with unethical use cases or used as a lure for malicious activity. There is no direct evidence of technical exfiltration or backdoors, but the nature of the tool warrants a suspicious classification due to its potential for misuse and safety policy violations.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may spend WeShop API credits and generate altered images.
The skill can start external image-generation jobs and request multiple outputs, which is expected for the stated purpose but may consume provider credits or produce more images than intended if invoked without clear user approval.
POST /openapi/agent/runs — start a run ... batchCount ... default `1`; range `1-16`
Confirm the user-selected image and desired batch count before starting a run, especially if the account has paid usage or limited credits.
Anyone with the API key may be able to use the user's WeShop API access and possibly consume account credits.
The skill requires a WeShop API key to authenticate. This is purpose-aligned, and the instructions explicitly say the key should only be sent to openapi.weshop.ai.
requires": {"env": ["WESHOP_API_KEY"]} ... Auth: `Authorization: <API Key>`Store the key as an environment variable, do not paste it into unrelated tools, and rotate it if it may have been exposed.
Selected images are sent to WeShop for processing and may be stored or reused through provider URLs.
The skill documents uploading local images to a third-party provider and receiving a reusable URL. This is expected for the image-editing workflow, but photos of people can be sensitive.
POST /openapi/agent/assets/images — upload a local image and get a reusable URL
Only upload images you have rights and consent to process, avoid sensitive personal photos, and review WeShop's privacy and retention terms before use.