Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Digen Ai Free

v1.3.0

DigenAI image and video generation for OpenClaw. Supports image-to-video and text-to-image. Video generation via api.cowork.digen.ai with Bearer token. Trigg...

1· 114·0 current·0 all-time
byEeofol@eeoeofl

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for eeoeofl/digen-ai-free.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Digen Ai Free" (eeoeofl/digen-ai-free) from ClawHub.
Skill page: https://clawhub.ai/eeoeofl/digen-ai-free
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install eeoeofl/digen-ai-free

ClawHub CLI

Package manager switcher

npx clawhub@latest install digen-ai-free
Security Scan
Capability signals
CryptoCan make purchasesRequires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md describes an API client for DigenAI (image/video generation). Included Python client and scripts align with that purpose. However the package also contains Discord/Telegram bot code and shell run-scripts with embedded bot tokens and a MASTER_API_KEY. The registry metadata claims no required environment variables, but both the documentation and code expect/require DIGEN_API_KEY, DIGEN_TOKEN, DIGEN_SESSION_ID, DISCORD_BOT_TOKEN, TELEGRAM_BOT_TOKEN and a MASTER_API_KEY. Requiring a master API key and bot tokens is not strictly necessary for a simple client library or skill — the presence of key-distribution bots is additional functionality that should have been declared.
!
Instruction Scope
SKILL.md focuses on using the DigenAI client and setting DIGEN_API_KEY / DIGEN_TOKEN / DIGEN_SESSION_ID. It does not instruct the user to run the included bot scripts, but the repo contains run-discord.sh, run-telegram-bot.sh/run-tg.sh and bot implementations that will create and distribute API keys. The scripts set environment variables (including hard-coded tokens) and change directories to user-specific paths (/Users/mac/...), which is unexpected and brittle. The bots also persist user keys to a local user_keys.json file — collecting and storing generated keys locally, which increases attack surface and data exposure.
Install Mechanism
This is an instruction-only skill with no install spec. No downloads or extraction operations are present in the metadata. The risk comes from files included in the bundle (scripts and bots) rather than from an installer.
!
Credentials
The skill metadata declared no required env vars, but the code expects multiple secrets: DIGEN_API_KEY (new API), DIGEN_TOKEN and DIGEN_SESSION_ID (old API), DISCORD_BOT_TOKEN, TELEGRAM_BOT_TOKEN, and a MASTER_API_KEY used to mint per-user keys. Worse, a MASTER_API_KEY value and bot tokens are embedded directly in code and shell scripts. A master API key that can create other API keys is high-privilege; embedding it in the shipped code (and in run-*.sh) is disproportionate and dangerous. The skill also writes and reads a local user_keys.json containing per-user API keys — again sensitive.
Persistence & Privilege
The skill is not marked always:true and does not request platform-wide privileges. However, the included bot code is designed to run as persistent services (polling Discord/Telegram) and to persist data (user_keys.json) and may run outside the agent lifecycle if a user executes the run scripts. That persistent behavior is not described in the skill metadata and could have long-lived effects if someone runs the scripts.
Scan Findings in Context
[hardcoded-discord-bot-token] unexpected: assets/run-discord.sh contains a hard-coded DISCORD_BOT_TOKEN and assets/discord-bot.py prints Master API Key. Embedding bot tokens in distributed code is not expected for a client SDK and is a security risk.
[hardcoded-telegram-bot-token] unexpected: assets/run-telegram-bot.sh and assets/run-tg.sh contain a hard-coded TELEGRAM_BOT_TOKEN. Bot tokens should be supplied by the operator via environment variables, not encoded in scripts.
[hardcoded-master-api-key] unexpected: MASTER_API_KEY (an `ak_...` master key) is hard-coded as a default in discord-bot.py, telegram-bot.py, and included in the run scripts. This is high-privilege (can create keys) and should never be shipped in plaintext with the skill.
[local-path-execution] unexpected: run-*.sh scripts cd into /Users/mac/.openclaw/workspace/skills/digen-ai-free/assets — a user-specific absolute path, not portable and unexpected in a published skill.
What to consider before installing
This skill contains code that is consistent with a DigenAI client, but also includes Discord/Telegram bot scripts and hard-coded secrets. Before installing or running anything: - Do NOT run the provided run-*.sh scripts or launch the included bots without review. They contain hard-coded bot tokens and a MASTER_API_KEY which are sensitive and likely already compromised; assume these values are public and rotate any affected credentials. - Treat any embedded 'ak_*' keys or bot tokens in the package as leaked. If you control those accounts, revoke and rotate them immediately. Do not reuse those keys. - The skill metadata declares no required env vars, but the code expects DIGEN_API_KEY, DIGEN_TOKEN, DIGEN_SESSION_ID, plus bot tokens and a MASTER_API_KEY. If you only need the client, remove or ignore the bot assets and run only the digen_ai_client code; set API keys in your environment rather than using bundled defaults. - The bots persist user_keys.json locally; that file will contain generated API keys in plaintext. If you run a bot, store that file securely, restrict access, or use a secure backend for keys instead. - If you want to use the skill as an end user: ask the publisher to remove embedded credentials, update the skill metadata to declare required env vars, and avoid bundling live master tokens in distributed code. If the source is untrusted or you cannot get assurances, consider using only the client code after auditing it and supply your own API keys. Given the mismatches and embedded secrets, the package is suspicious and requires remediation or clarification from the publisher before safe use.

Like a lobster shell, security has layers — review code before you run it.

aivk973e9yqtdbgt6qx3c2mhfyc8n84wg8kdigenvk973e9yqtdbgt6qx3c2mhfyc8n84wg8kdiscordvk976kqxef7cx2m4mwevzpq6e7984wz32freevk973e9yqtdbgt6qx3c2mhfyc8n84wg8kimage-generationvk973e9yqtdbgt6qx3c2mhfyc8n84wg8klatestvk97enn9agwvh84djn6cdvb4t9x85fg76telegramvk976kqxef7cx2m4mwevzpq6e7984wz32video-generationvk973e9yqtdbgt6qx3c2mhfyc8n84wg8k
114downloads
1stars
15versions
Updated 3d ago
v1.3.0
MIT-0

DigenAI Skill

Generate images from text prompts and videos from images via DigenAI API.

⚠️ First Time Users: Get Your Free API Key

Video generation requires a free API key (starts with ak_).

How to Get Your API Key

  1. Visit: https://claw.digen.ai
  2. Or join Discord: https://discord.gg/SRhbTt9hwp
  3. Or contact Telegram: @digen_skill_bot

Your API key is used as:

Authorization: Bearer YOUR_API_KEY

Note: The API uses https://api.cowork.digen.ai as the base URL.


Quick Start

from digen_ai_client import DigenAIClient

# Video generation — requires API Key (ak_xxx)
client = DigenAIClient(api_key="ak_xxxxxxxxxxxxxxxxxxxx")

Image Generation (Old API)

Uses api.digen.ai with DIGEN_TOKEN + DIGEN_SESSION_ID

Available Models

ModelDescription
defaultHigh quality model

Example

from digen_ai_client import DigenAIClient

client = DigenAIClient(
    old_api_token="your_token",
    old_api_session="your_session"
)

result = client.generate_image_sync(
    prompt="futuristic cyberpunk city at night, neon lights, rainy streets, highly detailed, 8K",
    model="default",
    resolution="1:1"
)

if result["success"]:
    print(f"✅ Image: {result['images'][0]}")
else:
    print(f"❌ Error: {result.get('error')}")

Video Generation (New API)

Uses new API with Bearer API Key

⚠️ Important: Use model="turbo"

The video generation API requires model="turbo" parameter (not default).

Available Models

ModelDescriptionMax Duration
turboFast and high quality generation10s

Video Types

  • Image-to-Video: ✅ Works - requires image_url + prompt
  • Text-to-Video: ⚠️ May not work with all API keys (depends on credits)

Example: Image-to-Video (Recommended)

from digen_ai_client import DigenAIClient

client = DigenAIClient(api_key="ak_xxxxxxxxxxxxxxxxxxxx")

result = client.generate_video_sync(
    image_url="https://your-image.jpg",
    prompt="gentle camera pan left, neon lights twinkling",
    model="turbo",  # IMPORTANT: use "turbo", not "default"
    duration=5
)

if result["success"]:
    print(f"✅ Video: {result['video_url']}")
    print(f"   Thumbnail: {result['thumbnail_url']}")
else:
    print(f"❌ Error: {result.get('error')}")

Example: Text-to-Video (May Not Work)

client = DigenAIClient(api_key="ak_xxxxxxxxxxxxxxxxxxxx")

result = client.generate_video_sync(
    prompt="A cute cat playing piano in a cozy room, soft lighting",
    model="turbo",
    duration=5
)

if result["success"]:
    print(f"✅ Video: {result['video_url']}")
else:
    print(f"❌ Error: {result.get('error')}")
    # Note: Text-to-Video may fail if your API key only has image-to-video credits

API Key Management (New API)

Check API Key Info

client = DigenAIClient(api_key="ak_xxx")
info = client.get_api_key_info()
print(info)
# {'success': True, 'data': {'api_key': 'ak_xxx', 'status': 1, 'created_at': '...'}}

Upload Image

result = client.upload_image(file_path="/path/to/image.jpg")
if result["success"]:
    print(f"Image URL: {result['url']}")

Configuration

Environment Variables

VariableDescription
DIGEN_TOKENOld API token for image generation
DIGEN_SESSION_IDOld API session ID for image generation
DIGEN_API_KEYNew API key (ak_xxx) for video generation

Setup

# Image generation (old API)
export DIGEN_TOKEN="your_token"
export DIGEN_SESSION_ID="your_session"

# Video generation (new API)
export DIGEN_API_KEY="ak_xxxxxxxxxxxxxxxxxxxx"

Error Handling

No API Key Error (Video)

❌ API Key Not Found!

Get your free API key:
- Visit: https://claw.digen.ai
- Or join Discord: https://discord.gg/SRhbTt9hwp

Error Codes (New API)

HTTP CodeError CodeDescription
400invalid_requestInvalid or missing parameters
401invalid_api_keyInvalid or missing API key
402insufficient_creditsNot enough credits
404not_foundResource not found
500internal_errorInternal server error

API Reference

New API Endpoints (Video)

MethodEndpointDescription
GET/b/v1/api-keyGet API key info
POST/b/v1/uploadUpload image file
POST/b/v1/video/generateGenerate video
GET/b/v1/video/{id}Get video status

Base URL: https://api.cowork.digen.ai

Old API Endpoints (Image)

MethodEndpointDescription
POST/v2/tools/text_to_imageGenerate image
POST/v6/video/get_task_v2Get image status

Base URL: https://api.digen.ai


Scripts

  • scripts/digen_ai_client.py - Python client with sync/async support
  • scripts/batch_generate.py - Batch image generation utility
  • assets/telegram-bot.py - Telegram bot for API key distribution
  • assets/discord-bot.py - Discord bot for API key distribution

Tips

  • Video model: Always use model="turbo" (not default or seedance-2.0)
  • Image-to-Video: Requires image_url parameter
  • Text-to-Video: May not work with all API keys
  • Video generation: poll every 5 seconds, timeout 300s
  • Image generation: poll every 3 seconds, timeout 120s

Comments

Loading comments...