Cultural Naming & AI Art Creation

PassAudited by ClawScan on May 17, 2026.

Overview

This appears to be a benign cultural naming and AI-art skill, but users should notice that it can use external AI/image providers and store naming details in session memory.

This skill is reasonable for generating Chinese names, poems, and AI art. Before installing, be aware that it may use third-party AI/image services, may retain your name and preferences in session memory, and any separate GitHub version with helper scripts should be inspected before running.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Asking for the full package may generate multiple poems and images, which could use external model services or consume image-generation quota.

Why it was flagged

A full-package request can chain multiple text and image-generation modules. This matches the skill purpose, but users should understand that it may trigger several generation actions.

Skill content

auto_chain: ["name_generation", "poetry_jueju", "poetry_lushi", "seal_carving", "shanshui_painting", "portrait_avatar"]

Recommendation

Confirm which art outputs you want before requesting the full package, especially if image generation has cost or privacy implications.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If you install from a future GitHub repository or another package containing these referenced files, that extra code may not be covered by this review.

Why it was flagged

The guide references helper code files that are not present in the reviewed package, while the registry says this is instruction-only. There is no automatic install/run path shown, so this is a provenance note rather than a security concern.

Skill content

├── skill.py                            ✅ Python 核心逻辑
├── prompts.py                          ✅ 艺术提示词库

Recommendation

Install the reviewed instruction-only package, or inspect any repository scripts and dependencies before running them.

Low

#ASI06: Memory and Context Poisoning

What this means

Your name, preferred themes, gender preference, and generated cultural package may be retained for the session.

Why it was flagged

The skill stores personal naming information, preferences, and generated outputs in session memory. This is purpose-aligned but still involves personal context retention.

Skill content

session_memory:
    enabled: true
    keys:
      - "user_original_name"
      - "user_chinese_name"
      - "gender_preference"
      - "art_outputs"

Recommendation

Avoid sharing more personal information than needed, and clear the session if you do not want those details reused.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Names, preferences, poems, and art prompts may be processed by third-party AI services.

Why it was flagged

The manifest declares use of external text and image model providers. This is expected for a generative art skill, but user-provided names and generated prompts may be sent to those providers.

Skill content

"provider": "anthropic" ... "provider": "openai" ... "provider": "stability_ai"

Recommendation

Review the privacy terms of the configured model providers and avoid submitting sensitive personal details.