图可丽视觉api

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: tukeli-visual-api Version: 1.0.0 This skill bundle provides a legitimate interface for the Tukeli (图可丽) image processing API, supporting tasks like background removal, face enhancement, and AI-generated backgrounds. The implementation in `scripts/tukeli.py` and `scripts/config.py` follows standard practices, using the `requests` library to interact with the official API endpoint (picupapi.tukeli.net) and managing API keys through environment variables or a `.env` file. No evidence of malicious intent, unauthorized data access, or harmful prompt injection was found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Images chosen for processing leave the local environment, and successful API calls can consume Tukeli account credits.

Why it was flagged

The script uploads the selected local image file to the Tukeli API with request parameters and headers. This is expected for the skill’s purpose, but it is still an external, account-billed operation.

Skill content

files = {"file": (image_path.name, f, "image/jpeg")}
        resp = requests.post(
            url,
            params=url_params,
            files=files,
            headers=headers,

Recommendation

Use this skill only with images you are comfortable sending to Tukeli, and avoid bulk or repeated calls unless you intend to spend the credits.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent using the configured key can make API calls against the associated Tukeli account.

Why it was flagged

The skill uses a local Tukeli API key from an environment variable or .env file. This is purpose-aligned and disclosed, but it grants the skill authority to use the user’s Tukeli account.

Skill content

key = os.environ.get("TUKELI_API_KEY")
    if key:
        return key
    env_data = _parse_env_file(ROOT_DIR / ".env")
    return env_data.get("TUKELI_API_KEY")

Recommendation

Keep the API key private, store it only in the intended environment or .env file, and rotate it if it may have been exposed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Different installations could receive different versions of the dependency.

Why it was flagged

The skill depends on the external Python package requests with a lower-bound version rather than an exact pinned version. This is common and purpose-aligned, but installed package versions may vary over time.

Skill content

requests>=2.28.0

Recommendation

Install in a virtual environment and consider pinning dependency versions if you need reproducible or tightly controlled deployments.

Note

ASI06: Memory and Context Poisoning

What this means

Local output folders may reveal which images or URLs were processed.

Why it was flagged

The script writes metadata alongside output files that can include the local source path, image URL, and processing parameters. This is disclosed as output metadata, but it persists potentially sensitive file-location or URL information.

Skill content

"image_path": str(image_path) if image_path else None,
                "image_url": image_url,
                "params": url_params,

Recommendation

Review or delete generated .meta.json files if image paths, URLs, or processing details are sensitive.