Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

ImageRouter

Generate AI images with any model using ImageRouter API (requires API key).

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 2.2k · 2 current installs · 2 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The name and description (ImageRouter image generation) match the curl-based examples in SKILL.md that call imagerouter.io endpoints. However, the SKILL.md repeatedly shows an Authorization: Bearer YOUR_API_KEY header while the registry metadata lists no required environment variables or primary credential. That is an inconsistency: an API key is clearly needed for practical use but the skill does not declare it as a required credential.
Instruction Scope
The instructions are limited to calling ImageRouter endpoints and uploading local image files for image-to-image edits. They do not ask the agent to read unrelated system files or secrets. Two minor scope issues: (1) several examples pipe output through jq and xargs (jq is not declared as a required binary), and (2) examples instruct uploading local files (image[]=@/path/...) which transmits user files to the external API — a normal behavior for an image service but a privacy surface the user should be aware of.
Install Mechanism
No install spec and no code files (instruction-only). That minimizes local persistence and disk writes; risk from arbitrary installs is low.
!
Credentials
The skill does not declare any required environment variables, yet all authenticated API examples require an ImageRouter API key in an Authorization header. The absence of a declared primaryEnv or requires.env is disproportionate to the documented usage and creates ambiguity about how the agent will obtain/store the API key (user prompt, env var, or other).
Persistence & Privilege
The skill is not always-on, does not request elevated persistence, and is instruction-only. It does not request system-wide config changes or other skills' credentials.
What to consider before installing
This skill appears to be a straightforward curl-based guide for the ImageRouter API, but it has important inconsistencies you should address before installing: (1) it shows using an Authorization: Bearer <API_KEY> in every authenticated example yet declares no required credential — ask the publisher to declare a primaryEnv (e.g., IMAGEROUTER_API_KEY) or explain how the key is provided. (2) Examples use jq/xargs but jq is not listed as a required binary — ensure your environment has the tools the skill expects. (3) Using the skill will upload local image files to a third-party service (imagerouter.io); consider privacy implications and verify the service's trustworthiness and terms. If you plan to use this skill, require explicit handling of the API key (not placing it in logs/history), confirm where credentials come from, and prefer ephemeral or scoped keys where possible.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.0
Download zip
latestvk97ft84peefjdra1hsaxh65v8580d6g6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎨 Clawdis
Binscurl

SKILL.md

ImageRouter Image Generation

Generate images with any model available on ImageRouter using curl commands.

Available models

The test/test model is a free dummy model that is used for testing the API. It is not a real model, therefore you should use other models for image generation.

Get top 10 most popular models:

curl -X POST 'https://backend.imagerouter.io/operations/get-popular-models'

Search available models by name:

curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

curl "https://api.imagerouter.io/v1/models?type=image&sort=date&limit=1000"

Quick Start - Text-to-Image

Basic generation with JSON endpoint:

curl 'https://api.imagerouter.io/v1/openai/images/generations' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  --json '{
    "prompt": "a serene mountain landscape at sunset",
    "model": "test/test",
    "quality": "auto",
    "size": "auto",
    "response_format": "url",
    "output_format": "webp"
  }'

Unified Endpoint (Text-to-Image & Image-to-Image)

Text-to-Image with multipart/form-data:

curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=a cyberpunk city at night' \
  -F 'model=test/test' \
  -F 'quality=high' \
  -F 'size=1024x1024' \
  -F 'response_format=url' \
  -F 'output_format=webp'

Image-to-Image (with input images):

curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=transform this into a watercolor painting' \
  -F 'model=test/test' \
  -F 'quality=auto' \
  -F 'size=auto' \
  -F 'response_format=url' \
  -F 'output_format=webp' \
  -F 'image[]=@/path/to/your/image.webp'

Multiple images (up to 16):

curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=combine these images' \
  -F 'model=test/test' \
  -F 'image[]=@image1.webp' \
  -F 'image[]=@image2.webp' \
  -F 'image[]=@image3.webp'

With mask (some models require mask for inpainting):

curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=fill the masked area with flowers' \
  -F 'model=test/test' \
  -F 'image[]=@original.webp' \
  -F 'mask[]=@mask.webp'

Parameters

  • model (required): Image model to use (see https://imagerouter.io/models)
  • prompt (optional): Text description for generation. Most models require a text prompt, but not all.
  • quality (optional): auto (default), low, medium, high
  • size (optional): auto (default) or WIDTHxHEIGHT (e.g., 1024x1024).
  • response_format (optional):
    • url (default) - Returns hosted URL
    • b64_json - Returns base64-encoded image
    • b64_ephemeral - Base64 without saving to logs
  • output_format (optional): webp (default), jpeg, png
  • image[] (optional): Input file for Image-to-Image (multipart only)
  • mask[] (optional): Editing mask for inpainting (multipart only)

Response Format

{
  "created": 1769286389027,
  "data": [
    {
      "url": "https://storage.imagerouter.io/fffb4426-efbd-4bcc-87d5-47e6936bf0bb.webp"
    }
  ],
  "latency": 6942,
  "cost": 0.004
}

Endpoint Comparison

FeatureUnified (/edits)JSON (/generations)
Text-to-Image
Image-to-Image
Encodingmultipart/form-dataapplication/json

Tips

  • Both /v1/openai/images/generations and /v1/openai/images/edits are the same for the unified endpoint
  • Use JSON endpoint for simple text-to-image when you don't need file uploads
  • Use unified endpoint when you need Image-to-Image capabilities
  • Check model features at https://imagerouter.io/models (quality support, edit support, etc.)
  • Get your API key at https://imagerouter.io/api-keys

Examples by Use Case

Quick test generation:

curl 'https://api.imagerouter.io/v1/openai/images/generations' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  --json '{"prompt":"test image","model":"test/test"}'

Download image directly:

curl 'https://api.imagerouter.io/v1/openai/images/generations' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  --json '{"prompt":"abstract art","model":"test/test"}' \
  | jq -r '.data[0].url' \
  | xargs curl -o output.webp

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…