Trusted — Risk Score 5/100
Last scan:21 hr ago Rescan
5 /100
keevx-image-generate
Use the Keevx API to generate images from prompts and reference images
Pure documentation skill for Keevx image generation API with no executable code, scripts, or suspicious behavior; the API key shown is a clear placeholder requiring user replacement.
Skill Namekeevx-image-generate
Duration23.0s
Enginepi
Safe to install
No action needed. This is a safe, well-documented skill.

Findings 1 items

Severity Finding Location
Info
API key placeholder in documentation Doc Mismatch
SKILL.md shows 'your_api_key_here' as placeholder for API key configuration. This is standard documentation practice, not a security issue.
export KEEVX_API_KEY="your_api_key_here"
→ This is acceptable documentation practice. No action needed.
SKILL.md:15
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE No file operations in SKILL.md
Network READ READ ✓ Aligned Documents API calls to api.keevx.com
Shell NONE NONE No shell execution, only curl examples in documentation
Environment READ READ ✓ Aligned Documents reading KEEVX_API_KEY env var
1 High 8 findings
🔑
High API Key 疑似硬编码凭证
API_KEY="your_api_key_here"
SKILL.md:15
🔗
Medium External URL 外部 URL
https://www.keevx.com/main/home.
SKILL.md:12
🔗
Medium External URL 外部 URL
https://docs.keevx.com
SKILL.md:12
🔗
Medium External URL 外部 URL
https://api.keevx.com/v1
SKILL.md:20
🔗
Medium External URL 外部 URL
https://api.keevx.com/v1/figure-resource/upload/file
SKILL.md:47
🔗
Medium External URL 外部 URL
https://api.keevx.com/v1/image_generate
SKILL.md:75
🔗
Medium External URL 外部 URL
https://api.keevx.com/v1/image_generate/i2is-xxxxxxxx
SKILL.md:106
🔗
Medium External URL 外部 URL
https://www.keevx.com/main/meta/creations
SKILL.md:218

File Tree

1 files · 7.8 KB · 266 lines
Markdown 1f · 266L
└─ 📝 SKILL.md Markdown 266L · 7.8 KB

Security Positives

✓ No executable code or scripts present - pure documentation skill
✓ All network operations are to documented, legitimate API endpoints (api.keevx.com)
✓ No credential harvesting or exfiltration patterns detected
✓ No sensitive file/path access observed
✓ No obfuscation or anti-analysis techniques present
✓ No supply chain dependencies with known vulnerabilities
✓ Documentation accurately describes the skill's behavior