Back to skill
Skillv1.0.2
ClawScan security
Seedream 5.0 — AI Image Generation & Editing by ByteDance · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 18, 2026, 4:11 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and required credential (ATLASCLOUD_API_KEY) are consistent with the stated purpose of calling Atlas Cloud's Seedream image-generation API; nothing requests unrelated privileges or hidden endpoints.
- Guidance
- This skill appears to do exactly what it claims: it sends prompts and (optionally) uploaded images to Atlas Cloud and downloads generated images. Before installing, be aware that (1) the ATLASCLOUD_API_KEY you provide is a full account key (no scoping) and will be used for billing, (2) any images you upload or remote image URLs you reference will be transmitted to an external service — do not upload sensitive or private images, and (3) verify you trust the Atlas Cloud service and the skill publisher if you care about privacy or billing. If you want extra caution, review the script locally before running and run it in an isolated environment or account with limited funds.
Review Dimensions
- Purpose & Capability
- okName/description advertise Seedream image generation and editing; the script and SKILL.md only call api.atlascloud.ai and accept model IDs, prompts, and image URLs — all coherent with the stated purpose.
- Instruction Scope
- okRuntime instructions and the Python script only perform model listing, image upload, generation submission, polling, and downloading results. The SKILL.md explicitly warns that prompts and image URLs are sent to Atlas Cloud. There is no instruction to read unrelated local files or secrets.
- Install Mechanism
- okNo install spec and the included script uses only the Python standard library. No external downloads, package installs, or archive extractions are requested.
- Credentials
- noteOnly ATLASCLOUD_API_KEY is required — appropriate for an API client. SKILL.md warns Atlas Cloud does not support scoped keys, so the key grants access to all models and billing on the account; this is a proportional but important privacy/billing consideration.
- Persistence & Privilege
- okSkill is not always-on, does not request elevated persistence, and does not modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.