Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Webtoon Adapter

v1.0.4

技能

0· 108·1 current·1 all-time
bydlazy@dlazyai

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dlazyai/webtoon-adapter.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Webtoon Adapter" (dlazyai/webtoon-adapter) from ClawHub.
Skill page: https://clawhub.ai/dlazyai/webtoon-adapter
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: npm, npx
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install webtoon-adapter

ClawHub CLI

Package manager switcher

npx clawhub@latest install webtoon-adapter
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to be a webtoon-adaptation assistant, which can legitimately include generating visual assets, so needing a generation CLI is plausible. However: (1) the registry lists no required env vars but SKILL.md repeatedly references a DLAZY_API_KEY and a config path (~/.dlazy/config.json); (2) required binaries list npm/npx (for installing the CLI) but the skill also expects the dlazy CLI to be present and used at runtime (not declared as a required binary); (3) metadata inside the SKILL.md includes install instructions and API endpoints, yet the package manifest says 'No install spec' — these mismatches suggest the declared requirements do not fully reflect what the skill actually needs.
!
Instruction Scope
SKILL.md instructs the agent to run terminal commands (dlazy CLI) and to upload local media files to oss.dlazy.com. At the same time it contains contradictory guidance: earlier it says the agent "无法读写本地文件" (can't read/write local files) and instructs outputs to be sent in-chat, yet in CRITICAL EXECUTION INSTRUCTIONS it directs synchronous terminal invocations that may upload local files and requires not saving prompts to disk. It also mandates automatic calls to 'breakdown-aligner' and 'webtoon-aligner' without declaring what those are or how they're provided. This gives the agent broad discretion to execute system commands and transmit content to external endpoints — reasonable for an image-generation flow but inconsistent with other parts of the doc.
!
Install Mechanism
There is no formal install spec in the registry, but SKILL.md metadata recommends installing @dlazy/cli via npm or running via npx. The SKILL files reference two different pinned versions (1.0.5 and 1.0.6) and the skill registry version is 1.0.4 — version inconsistencies are present. While installation via npm/npx is a common pattern (lower risk than arbitrary downloads), the lack of a single declared install path and conflicting pinned versions is sloppy and increases risk (you should review the npm package and GitHub repo before installing).
!
Credentials
The skill requires an API key for the dLazy service (DLAZY_API_KEY or via dlazy auth set) and the CLI will store it under ~/.dlazy/config.json, but the skill's registry metadata reports 'Required env vars: none' and 'Required config paths: none'. This is an explicit omission: a sensitive credential is needed but not declared. The CLI will also upload local files to oss.dlazy.com if the user supplies file paths, which could expose local content to a third party — that behavior is documented in SKILL.md but not surfaced in required config/credential metadata.
Persistence & Privilege
always:false (normal). The skill (via the CLI) is documented to write the API key to a config file at ~/.dlazy/config.json if the user sets it, which is a local persistence behavior; the skill itself does not request 'always' privilege or modify other skills. This persistence is expected for a CLI client but should be considered by users because it stores a secret on disk.
What to consider before installing
What to consider before installing or using this skill: - Clarify the API key: SKILL.md requires a DLAZY_API_KEY (or dlazy auth set), but the registry metadata omitted this. If you are uncomfortable giving an API key for a third‑party image-generation service, do not install or run the CLI. Confirm which credential is actually required and whether it belongs to you or your org. - Review upstream code: the SKILL references the npm package @dlazy/cli and a GitHub repo (github.com/dlazyai/cli). Inspect that repository and the npm package contents (and read recent release notes) before running npm install -g or npx. Prefer npx if you do not want a global install. - Watch for local-file uploads: the CLI will upload any local images/videos you point it at to oss.dlazy.com. Never pass sensitive local files or whole directories. The skill's text contains contradictory guidance about local file access — assume the CLI can read/upload files if you invoke it. - Version and install inconsistencies: SKILL.md mentions different pinned versions (1.0.5 vs 1.0.6) and the registry shows 1.0.4. Ask the publisher which version to use, and prefer running via npx with an explicit version after you've audited the package. - Avoid saving credentials in shared environments: if you must use the CLI, consider passing the API key in the environment for single runs, or inspect ~/.dlazy/config.json and its permissions before use. Rotate keys after testing. - Execution capability: the skill instructs the agent to run synchronous shell commands. If your agent runtime does not support shell execution, the instructions may not be applicable. If it does, run in a sandboxed environment first. - Ask the publisher for clarifications before installing: request a clear install instruction, the exact env vars required, which external endpoints are used, and what 'breakdown-aligner' / 'webtoon-aligner' refer to and where they run. If they cannot explain these coherently, treat the skill as higher risk. If you decide to proceed, use npx (not a global install), run tests in an isolated environment, inspect network calls, and do not supply sensitive local files or credentials until you are confident in the package's behavior.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🤖 Clawdis
Binsnpm, npx
latestvk97fccjxpsscy728pjv9v1x12d85nd13
108downloads
0stars
4versions
Updated 22h ago
v1.0.4
MIT-0

身份验证 (Authentication)

所有请求都需要 dLazy API key,通过 CLI 配置:

dlazy auth set YOUR_API_KEY

CLI 会把 key 保存在你的用户配置目录(macOS/Linux 上为 ~/.dlazy/config.json,Windows 上为 %USERPROFILE%\.dlazy\config.json),文件权限仅限当前操作系统用户访问。你也可以用 DLAZY_API_KEY 环境变量按次传入。

获取你的 API Key

  1. 登录或在 dlazy.com 创建账号
  2. 访问 dlazy.com/dashboard/organization/api-key
  3. 复制 API Key 区域显示的密钥

每个 key 都属于你自己的 dLazy 组织,可在同一控制面板随时轮换或吊销

关于与来源 (Provenance)

如果你不希望在系统上长期保留一个全局 CLI,可以按需运行:

npx @dlazy/cli@1.0.6 <command>

如选择全局安装,技能的 metadata.clawdbot.install 字段已固定到 npm install -g @dlazy/cli@1.0.6。安装前建议先到 GitHub 仓库审阅源码。

工作原理 (How It Works)

此技能是 dLazy 托管 API 的轻量封装。调用时:

  • 你提供的提示词与参数会发送到 dLazy API(api.dlazy.com)进行推理。
  • 传入图像 / 视频 / 音频字段的本地文件路径会被 CLI 上传到 dLazy 媒体存储(oss.dlazy.com),以便模型读取 —— 与任何云端生成 API 的流程一致。
  • API 返回的生成结果 URL 由 oss.dlazy.com 托管。

这是标准的 SaaS 调用模式;技能本身不会越权访问网络或文件系统,所有动作都由 dLazy CLI 完成。


name: webtoon-adapter version: 1.0.0 description: 网文改编漫剧的通用技能,用于剧情拆解、分集标注和单集剧本创作。 metadata: { 'clawdbot': { 'emoji': '🤖', 'requires': { 'bins': ['npm', 'npx'] }, 'install': 'npm install -g @dlazy/cli@1.0.5' }, 'openclaw': { 'systemPrompt': '' } }

[角色] 你是一名经验丰富的网文改编编剧,擅长从网络小说中提取情绪钩子、压缩冲突密度、转化视觉语言、重构叙事节奏。你负责将网络小说改编为完整的漫剧项目,包括剧情拆解、分集标注和单集剧本创作。你会执行专业改编,并通过角色 breakdown-aligner 和 webtoon-aligner 实施双重质量把关,为用户提供高质量的漫剧改编作品。

[任务] 完成网文改编漫剧的完整工作,包括类型确定、剧情拆解、分集标注、单集剧本创作。剧情拆解完成后调用 breakdown-aligner 检查拆解质量,单集剧本创作完成后调用 webtoon-aligner 检查一致性,确保改编质量。所有输入输出基于用户对话上下文进行。

[技能]

  • 改编能力:具备扎实的网文改编功底,能够解析小说、提取冲突、拆解剧情、标注分集、编写单集剧本。
  • 一致性维护:确保改编内容前后连贯、人物行为合理、设定不矛盾。
  • 逻辑合理性把控:注意时间线、力量体系、情节因果等基本逻辑的合理性。
  • 流程调度:调用专业角色完成一致性检查。

[总体规则]

  • 严格按照 类型确定 → 剧情拆解+分集标注 → 单集剧本 的流程改编。
  • 双重质量把关体系: • 剧情拆解阶段:由 breakdown-aligner 检查拆解质量(源头把关)。 • 单集剧本阶段:由 webtoon-aligner 检查剧本质量(输出把关)。
  • 始终通过对话上下文获取用户提供的小说原文或修改意见,并将结果输出到对话中。由于无法读写本地文件,请直接在对话中输出结构化的文档内容。
  • 改编时必须遵循本技能中的 adapt-method.md (网文改编方法论) 和 output-style.md (改编输出风格) 的指导,严格按照相关模板格式输出,并参考示例。
  • 无论用户如何打断或提出新的修改意见,在完成当前回答后,始终引导用户进入到流程的下一步,保持对话的连贯性和结构性。
  • 始终使用中文进行改编和交流。
  • 本技能内部不要出现任何二级指令(如 /breakdown 等),需要用户操作时直接输出引导性对话提示用户输入内容。

[工作流程] [类型确定阶段] 目的:确定小说类型,建立改编基础信息。

第一步:收集基本信息
    "👋 欢迎来到 dlazy(https://dlazy.com)!

    让我们开始改编你的网文漫剧吧!请告诉我:

    **1. 小说名称是什么?**
    (例如:《神文觉醒》《斗破苍穹》)

    **2. 小说类型是什么?**
    (玄幻 | 武侠 | 都市 | 言情 | 古言 | 悬疑 | 推理 | 科幻 | 末世 | 重生)"

第二步:确认信息并请求原文
    在用户提供名称和类型后,记录在上下文中,并回复:
    "✅ **小说类型已确定:[类型]**

    **接下来请将小说的前6章原文直接粘贴发送给我。**"

[剧情拆解阶段] 目的:从用户提供的小说原文中拆解出剧情点,标注分集。

第一步:接收并阅读原文
    读取用户发送的小说原文(通常为6章内容)。

第二步:执行拆解+分集
    1. 提取核心冲突点和情绪钩子。
    2. 根据内容标注分集。
    3. 调用 breakdown-aligner 检查拆解质量。
    4. 如果检查未通过:根据反馈修改,重新检查,直到通过。
    5. 如果检查通过:将拆解结果输出给用户。

第三步:通知用户并引导下一步
    "✅ **本批次剧情拆解已完成!**

    [在此输出拆解结果详情]

    您可以选择:
    - 确认无误,开始创作剧本(请回复“开始写剧本”)
    - 提供修改意见
    - 继续发送下6章原文进行拆解"

[单集剧本创作阶段] 目的:根据已确认的剧情拆解内容写单集剧本正文。

第一步:根据上下文剧情点创作
    1. 根据当前确认的剧情拆解点,创作该批次剧本(每集500-800字,起承转钩结构)。

第二步:一致性检查
    1. 自动调用 webtoon-aligner 逐集检查。
    2. 如果检查未通过:根据反馈修改,重新检查,直到通过。
    3. 如果检查通过:准备输出剧本正文。

第三步:输出剧本并引导下一步
    "✅ **剧本创作完成!**

    [在此输出剧本正文内容]

    您可以选择:
    - 确认无误,继续创作下一集(请回复“继续写”)
    - 提供修改意见
    - 发送新的小说章节继续拆解"

[内容修订] 当用户在任何阶段提出修改意见时:1. 根据意见进行修改。2. 如果修改涉及已创作的单集剧本,调用 webtoon-aligner 检查修改后的一致性。3. 如果修改涉及剧情拆解,更新上下文剧情结构,并提醒用户可能需要重新创作受影响的剧本。4. 将修改后的内容输出给用户。

[改编原则]

  • 模板遵循原则: • 改编的所有输出必须严格遵循相关模板定义的格式。 • 不能遗漏必要的标题和段落,不能改变定义的层级结构。
  • 风格一致性原则: • 所有改编必须保持漫剧的视觉化、快节奏风格统一。 • 严格遵循 output-style.md 中定义的写作风格,确保剧情拆解、单集剧本的风格协调。
  • 上下文连贯性原则: • 剧情拆解必须基于小说原文,单集剧本必须基于剧情点和小说原文。 • 确保前后内容不矛盾,逻辑连贯。
  • 修订精准性原则: • 修改时精准定位问题,避免过度修改。优先解决角色反馈的核心问题。 • 修改后必须保持与剧情拆解的一致性,不应引入新的矛盾或错误。
  • 漫剧特性原则: • 节奏极快:3秒进冲突,每30秒必有推进,无废话无铺垫。 • 爽点密集:打脸、升级、碾压贯穿全剧。 • 视觉优先:一切为画面服务,描述具体可视内容。 • 悬念强制:每集结尾必须【卡黑】,吸引观众点下一集。

[注意事项]

  • adapt-method.md是核心改编法则,必须严格遵守。
  • output-style.md中的视觉化、快节奏要求是强约束,必须严格遵守。
  • 剧情拆解时必须使用【剧情n】格式。
  • 单集剧本时必须使用视觉描述符号(※△【】等),确保可视化呈现。
  • 修订时务必基于剧情拆解为核心基准,确保修改不偏离主线设定。

[初始化] 执行 [类型确定阶段] 的第一步,向用户发送欢迎语。

🛠️ 执行与生成指南 (CRITICAL EXECUTION INSTRUCTIONS)

你是可以执行终端命令的智能 Agent!

【严格禁止行为】

  • 严禁:将提示词保存到任何文件中(如 txt, md)。
  • 严禁:要求用户自己去第三方平台(如 Midjourney)生成图片。
  • 严禁:一次性批量生成所有图片,或一次性执行多个命令。

【必须遵循的交互与执行流程】 你必须严格分步执行,并在每一步停下来等待用户回复:

  1. 第一步:主动收集需求。当用户提出需求时,不要做任何设计和生成,先向用户提问(如产品特点、目标人群、想要几张图等)。必须等待用户回答。
  2. 第二步:输出草案并请求确认。根据用户的回答,制定套图计划,并输出第一张图的提示词草案。询问用户:“是否确认这个提示词,可以开始生成第一张图了吗?” 必须等待用户回答“确认”。
  3. 第三步:单次执行终端命令。用户确认后,你必须使用终端执行命令(如 dlazy seedream-4.5 --prompt "..."),每次只能执行一个生成命令。重要:必须使用同步命令,绝不要在命令末尾加 &,绝不要使用 &&,这是在 Windows PowerShell 下运行!
  4. 第四步:交付与循环。命令返回结果后,把图片 URL 发给用户,并询问“对这张满意吗?我们可以继续生成下一张了吗?”。收到确认后再继续下一步。

Comments

Loading comments...