Generate Tesla Car Wraps
v1.0.0Call Craftsman Agent API OneKey Router to generate Tesla Car Wrap Images and Paints that will display on 3D screen.
⭐ 1· 84·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (generate Tesla car wraps via a OneKey router) aligns with the artifacts: both included scripts and SKILL.md call a OneKey agent router and require DEEPNLP_ONEKEY_ROUTER_ACCESS. Minor mismatch: SKILL.md lists npm and python packages (onekey-gateway, ai-agent-marketplace) and a recommended CLI that are not imported by the included scripts (the scripts call the HTTP endpoint directly), which is plausible if the CLI is a separate recommended tool but is worth verifying.
Instruction Scope
Runtime instructions are narrowly scoped to sending a JSON payload (prompt, image URLs, mode, car model, count) to https://agent.deepnlp.org/agent_router using the X-OneKey header. The SKILL.md does not instruct the agent to read unrelated files or environment variables. Small implementation issue: both scripts warn if the API key is missing but then continue and send an empty header value rather than exiting — this is a bug but not an indicator of malicious intent.
Install Mechanism
This is an instruction-only skill with included scripts; there is no download-from-arbitrary-URL or extract step. SKILL.md suggests npm/pip installs for convenience (global CLI and a python package). Those are typical and not inherently risky, though you should verify the npm package (@aiagenta2z/onekey-gateway) and pip package provenance before global installation.
Credentials
Only one required environment variable is declared (DEEPNLP_ONEKEY_ROUTER_ACCESS) and that is used as the OneKey API key in requests. No unrelated credentials, config paths, or secrets are requested.
Persistence & Privilege
The skill does not request permanent/always-on presence and uses default agent invocation settings. It does not modify other skills or system-wide configs.
Assessment
This skill appears coherent: it sends your DEEPNLP_ONEKEY_ROUTER_ACCESS key in an X-OneKey header to https://agent.deepnlp.org/agent_router to request generated wrap images. Before installing or running: (1) verify the OneKey API provider (DeepNLP) is trustworthy and that the key you provide is scoped appropriately (don’t use broad or high-privilege keys); (2) inspect or vet the npm package @aiagenta2z/onekey-gateway and the pip package ai-agent-marketplace before installing globally; (3) be aware the bundled scripts will attempt the request even if the env var is unset (they warn but do not exit) — consider setting a non-sensitive test key or modifying the script to abort if no key is present; (4) review network/endpoint policies if you need to restrict outbound traffic to known hosts. If you need higher assurance, ask the publisher for a canonical homepage/source repo and signed releases for the CLI packages before use.scripts/generate_tesla_wraps.ts:55
Environment variable access combined with network send.
Confirmed safe by external scanners
Static analysis detected API credential-access patterns, but both VirusTotal and OpenClaw confirmed this skill is safe. These patterns are common in legitimate API integration skills.Like a lobster shell, security has layers — review code before you run it.
latestvk975vaqw2zvytc3dtj77gkqbmn83qhm1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.