Ai Image Generator

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only image-generation skill is broadly coherent, but users should notice that it asks for an API key and references setup commands/files that are not included in the package.

Before installing, confirm where the image-generation code comes from, do not run an untrusted generate.py, and protect any API key you use because it may incur provider charges.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user may need to supply or locate missing code before the example works, and should verify any script they run.

Why it was flagged

The skill documents package installation and running a local generate.py script, but the provided manifest contains only SKILL.md and no generate.py file or install spec.

Skill content

pip install openai pillow

# 生成图片
python generate.py "一只可爱的猫咪在咖啡店里喝咖啡，动漫风格"

Recommendation

Only run local scripts from a trusted source; the publisher should include the referenced file or revise the instructions to avoid implying bundled code exists.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using an API key can authorize paid image generation or other account activity with the provider.

Why it was flagged

The skill expects an API key for an external image-generation model, while the registry metadata declares no primary credential or required environment variables.

Skill content

"api_key": "your-api-key",
  "model": "dall-e-3"

Recommendation

Use a narrowly scoped key if possible, store it securely, and check provider billing/usage limits before using the skill.