Blog Image Claw Skill

Generate blog image claw images using the Neta AI API. Returns a direct image URL.

Security Scan

The skill appears to implement the stated image-generation purpose, but registry metadata and docs don't match the code (it requires a NETA_TOKEN and reads local .env files) — this mismatch and a couple of doc/code inconsistencies warrant caution.

Purpose & Capability

The skill's description says it generates images with the Neta API, which matches the code. However the registry metadata declares no required environment variables or primary credential while the code and SKILL.md require a NETA_TOKEN (via env or --token). That missing declaration is an incoherence.

Instruction Scope

Runtime instructions are limited to running the bundled Node script which calls the Neta API — that's within scope. The script also looks for a token in two specific local dotfiles (~/.openclaw/workspace/.env and ~/developer/clawhouse/.env), which is somewhat unexpected (but understandable for convenience). There's also a docs/code mismatch: README suggests NETA_API_BASE_URL for custom endpoints while the code actually reads NETA_API_URL.

Install Mechanism

No install spec or remote downloads; the skill is instruction-only with a small included script and package.json. No external code is fetched during install.

Credentials

The code requires a secret API token (NETA_TOKEN) but the skill metadata does not declare it. The script will read two user dotfiles to locate the token; while it only extracts NETA_TOKEN, reading arbitrary .env files may surprise users and could expose unexpected secrets if those files contain other sensitive values.

Persistence & Privilege

The skill does not request permanent/always-on inclusion, does not modify other skills, and does not write to system-wide settings. It only runs when invoked.

What to consider before installing

This skill appears to do what it says (call Neta to generate images), but there are a few red flags you should consider before installing: - The packaged script requires a NETA_TOKEN but the skill metadata does not list any required env vars. Treat this as an omission and assume you must provide your Neta API token to use it. - The script will try to read NETA_TOKEN from two local .env files (~/.openclaw/workspace/.env and ~/developer/clawhouse/.env). If you keep other secrets in those files, consider moving them or avoid relying on implicit file reads. Review the code to ensure it only extracts NETA_TOKEN. - Documentation and code disagree on the API base env var name (README mentions NETA_API_BASE_URL; the script uses NETA_API_URL). That mismatch can cause unexpected network calls if you try to customize endpoints. Confirm which env var to set or update the script/docs. - Network endpoints contacted appear limited to the Neta/talesofai API (api.talesofai.com). If you are uncomfortable, run the script in a sandbox or inspect/execute it locally with a throwaway token first. Actions you can take: inspect the bundled blogimageclaw.js yourself (it is included), verify it only reads the indicated files and only sends data to the Neta endpoints, and ask the publisher to update registry metadata to declare NETA_TOKEN and fix the README/env-var mismatch. If you store other secrets in the .env files the script reads, remove or isolate them before use.

Blog Image Generator

Generate stunning ai blog image generator images from a text description. Get back a direct image URL instantly.

When to use

Use when someone asks to generate or create ai blog image generator images.

Quick start

node blogimageclaw.js "your description here"

Options

• --size — portrait, landscape, square, tall (default: landscape)

Token

Requires a Neta API token via NETA_TOKEN env var or --token flag.

• Global: https://www.neta.art/open/
• China: https://app.nieta.art/security

export NETA_TOKEN=your_token_here

Install

npx skills add BarbaraLedbettergq/blog-image-claw-skill