Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

爱创AI-电商专用AI创作智能体工具_AI图片生成_AI视频生成_AI电商详情图生成

v1.0.0

爱创AI平台(www.51aic.com)电商AI内容创作助手。当用户有以下任何需求时,**必须**使用此技能: - 电商作图、商品图生成、主图套图、详情图制作 - AI生成图片、AI绘画、AI作图 - AI试衣、AI试鞋、AI试戴、虚拟试穿 - 商品精修、去水印、商品换色、服装去皱 - 图片翻译、商品替换背景、...

0· 34·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for howerlin0329/aicraft-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "爱创AI-电商专用AI创作智能体工具_AI图片生成_AI视频生成_AI电商详情图生成" (howerlin0329/aicraft-skill) from ClawHub.
Skill page: https://clawhub.ai/howerlin0329/aicraft-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install aicraft-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install aicraft-skill
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the instructions: the SKILL.md documents how to call the 爱创 (51aic / aicraft) APIs for image/video generation, uploads, and billing checks. Requested endpoints (aicraft.51aic.com, api.fzputi.com, oss.fzputi.com) are consistent with the stated platform.
!
Instruction Scope
Instructions explicitly tell users to open browser devtools, read the 'token' cookie and paste it into the conversation; the agent is instructed to store and reuse that token for all API calls. The skill also includes shell curl examples that will upload user files (base64) to a third‑party OSS. Collecting a session cookie and asking the user to paste it into the chat is high‑risk and broadens the data surface beyond simple prompt input.
Install Mechanism
Instruction‑only skill with no install spec and no code files; nothing is written to disk by an installer. This is the lowest install risk.
Credentials
The skill asks the user for a service session token (cookie) rather than declaring environment variables; requesting that token is proportionate to calling the provider's API, but a session cookie can grant full account access (including payments). The SKILL.md also describes obtaining a payment 'authorization' token via the API, which could expose billing info. No unrelated environment credentials are requested.
Persistence & Privilege
always is false and the skill does not request system‑wide privileges or modify other skills. It recommends caching the authorization token for ~2 hours within the conversation context, which is a normal optimization but increases blast radius if the token is exposed.
What to consider before installing
This skill appears to do what it claims (call 爱创/51aic APIs) but requires you to extract and paste your session 'token' cookie into the chat and uploads images to an OSS (oss.fzputi.com). Before installing or using it: - Treat the token as a sensitive secret: it likely grants full account access (including billing). Avoid pasting it into public chats or third‑party UIs you don't fully trust. Prefer provider‑issued API keys or ephemeral/limited accounts where possible. - If you must use it, create a throwaway or limited‑permission account, or log out / revoke the token after use. Consider changing your password or invalidating sessions afterwards. - Be cautious about uploading sensitive images (IDs, private photos). Uploaded files are sent to api.fzputi.com / oss.fzputi.com and may be stored there. - The SKILL.md's advice to copy a cookie value from browser devtools is functional but risky; ask the provider if there is an official API token flow or OAuth alternative. - Consider disabling autonomous invocation or only invoking the skill interactively while managing tokens manually, to reduce the chance the agent reuses the token without your consent. If you want, I can suggest safer alternatives (use provider API keys, create limited accounts, or use a local tool) or draft a minimal checklist to securely test this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fg4y4y9d1h03xbrnney3dt185pp74
34downloads
0stars
1versions
Updated 8h ago
v1.0.0
MIT-0

爱创AI平台技能

概述

爱创AI平台(https://www.51aic.com)是面向电商商家的AI内容创作平台,提供AI图片生成、AI视频生成、商品精修、虚拟试穿等全场景AI作图功能。

本技能允许用户在 Claude 对话中直接调用爱创AI平台的服务,无需手动访问网页。

认证流程

所有 API 调用都需要用户的 token。

如果用户没有提供过 token,按以下步骤引导用户获取:

  1. 请用户打开浏览器访问 https://www.51aic.com
  2. 点击右上角登录(支持手机号验证码或微信扫码)
  3. 登录成功后,按 F12 打开浏览器开发者工具
  4. 切换到 Application(Chrome)或 Storage(Firefox)标签页
  5. 在左侧导航找到 Cookieshttps://www.51aic.com
  6. 在 Cookie 列表中找到名为 token 的字段
  7. 复制该字段的值(通常是一串较长的字符串)
  8. 将复制的 token 粘贴到对话中

安全提示:token 是用户的登录凭证,请勿在公共对话中分享。对话中的 token 仅在当前会话有效。

获取到 token 后,保存到上下文中,后续所有 API 调用自动使用。

API 基础配置

主 API 地址:    https://aicraft.51aic.com
文件上传地址:   https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2
图片 CDN:      https://oss.fzputi.com/

所有请求需要在 HTTP Header 中携带:Token: <用户token>

核心能力

1. 图片上传

如果用户提供了本地图片文件,需要先上传到平台 OSS。

上传逻辑:

  1. 读取图片文件,转为 base64 编码
  2. 拼接成 data:image/jpeg;base64,... 格式
  3. 生成 OSS 路径:tools/aiCraft/1m/YYYYMMDD/<uuid>.<ext>
  4. POST 到上传接口

macOS/Linux:

FILE_PATH="<图片路径>"
B64=$(openssl base64 -in "$FILE_PATH" | tr -d '\n')
EXT="${FILE_PATH##*.}"
[ "$EXT" = "jpeg" ] && EXT="jpg"
UUID=$(uuidgen | tr '[:upper:]' '[:lower:]' | tr -d '-')
DATE=$(date +%Y%m%d)
MIME="image/$EXT"
[ "$EXT" = "jpg" ] && MIME="image/jpeg"

curl -s -X POST "https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d "{\"ossFilePath\":\"tools/aiCraft/1m/$DATE/$UUID.$EXT\",\"fileBase64\":\"data:$MIME;base64,$B64\"}"

Windows:

$FilePath = "<图片路径>"
$B64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes($FilePath))
$Ext = [System.IO.Path]::GetExtension($FilePath).TrimStart('.')
if ($Ext -eq "jpeg") { $Ext = "jpg" }
$UUID = [Guid]::NewGuid().ToString().Replace("-", "").ToLower()
$Date = Get-Date -Format "yyyyMMdd"
$MIME = "image/$Ext"
if ($Ext -eq "jpg") { $MIME = "image/jpeg" }

$Body = @{
    ossFilePath = "tools/aiCraft/1m/$Date/$UUID.$Ext"
    fileBase64 = "data:$MIME;base64,$B64"
} | ConvertTo-Json

$BodyBytes = [System.Text.Encoding]::UTF8.GetBytes($Body)
Invoke-RestMethod -Uri "https://api.fzputi.com/ossmanager/api/Oss/UploadFileV2" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body $BodyBytes

上传成功后会返回 https://oss.fzputi.com/... 的 URL,用于后续生成请求。

2. 图片生成(17种模式)

支持17种图片生成模式,详见 references/image-modes.md

最常用的是 自由创作 模式:

  • 上传参考图(可选,最多10张)
  • 输入提示词描述想要的图片
  • 选择图片比例和生成数量
  • 调用 API 生成

API 端点:POST https://aicraft.51aic.com/api/v1/Task/Publish

业务规则(重要):提交生成任务时,必须先查询并复用现有的 conversationId一律不创建新的 conversation(批次)。这样能保证所有记录在同一个会话下,查询历史时不会断档。

查询方式:POST /api/v1/Conversation/Search(projectType: IMAGE/VIDEO,按 lastMessageAt 倒序取第一条)

prompt 字段规则(重要)

  • 自由创作模式:prompt 由用户自定义,是核心必填参数,描述想要什么图片
  • 其他16种模式(如AI试衣、去水印等):有固定的默认 prompt(详见 references/image-modes.md),不可为空,否则任务发布会失败(code: 999)
  • 部分模式(如换色、翻译、换表情)的 prompt 包含动态参数(颜色、语言、表情等),需要根据用户选择填充

请求体示例(自由创作):

{
  "conversationId": "",
  "projectType": "IMAGE",
  "mode": 1,
  "type": 2,
  "payload": {
    "aspectRatio": "auto",
    "count": 1,
    "prompt": "一件红色连衣裙,白色背景,电商商品图",
    "sceneMode": "free_creation",
    "referenceImages": [
      { "key": "images", "index": 0, "url": "https://oss.fzputi.com/...", "description": "" }
    ]
  }
}

3. 视频生成(开发中)

注意:视频生成功能当前处于开发调试阶段,网页端视频页面暂时被重定向到首页。API 可能不稳定或不可用,建议优先使用图片生成功能。

支持商品讲解视频、带货视频、促销视频等多种类型。

API 端点:POST https://aicraft.51aic.com/api/v1/Task/Publish

配置参数详见 references/video-config.md

请求体示例(新手模式):

{
  "conversationId": "",
  "projectType": "VIDEO",
  "mode": 1,
  "type": 1,
  "payload": {
    "prompt": "介绍这款红色连衣裙的优点",
    "duration": 8,
    "orientation": "9:16",
    "size": "large",
    "language": "0",
    "videoType": "2",
    "videoChannel": "fast",
    "images": ["https://oss.fzputi.com/..."]
  }
}

4. 查询任务状态

生成任务提交后,返回 taskJobIdconversationId。可通过以下接口查询任务进度:

  • 任务进度: POST /api/v1/Task/GetProgress(支持批量查询,见下方 API 调用参考)

5. 查询积分

积分查询需要两步认证

  1. 获取支付认证 token:用用户 token 调用 /api/v1/PayPackage/GetToken(body: {"appType": 6}),返回 authorization
  2. 查询积分:用 authorization 作为 Authorization header,访问支付 API https://api.fzputi.com/payment/api/v1/Vas/GetQuantityByPackageType

返回用户的剩余积分(会员积分 + 套餐积分)。

authorization 缓存:有效期约 2 小时。在同一次对话中获取后可复用,不需要每次查积分都重新调用 GetToken。如后续调用返回 401,再重新获取。

注意:支付 API 与主 API 使用不同的认证机制。如果用户未主动要求查积分,可跳过此步骤,直接引用下方的积分消耗参考表告知用户大致消耗。

使用流程

图片生成流程

  1. 确认用户已提供 token(如未提供,引导获取)
  2. 询问用户需要什么类型的图片(自由创作/商品图/AI试衣等)
  3. 确认 prompt
    • 自由创作:询问用户想要什么图片,由用户描述生成 prompt
    • 其他模式:使用对应模式的默认 prompt(见 references/image-modes.md),如用户有特殊需求可在此基础上调整
    • 部分模式(换色/翻译/换表情等)需要额外确认动态参数(颜色/语言/表情等)
  4. 询问参考图片
  5. 如有本地图片,先调用上传接口
  6. 构建并发送 Publish 请求
  7. 返回任务提交结果,告知用户可在 https://www.51aic.com/image/history 查看

视频生成流程(开发中)

  1. 确认用户已提供 token
  2. 询问视频类型(商品讲解/带货/促销等)
  3. 询问参考图片和提示词
  4. 确认视频配置(通道/比例/清晰度/时长/语言)
  5. 如有本地图片,先调用上传接口
  6. 构建并发送 Publish 请求
  7. 返回任务提交结果

积分消耗参考

功能积分消耗
图片生成(自由创作)5积分/张
主图套图25积分/套
视频生成(极速通道8秒)30积分
视频生成(高稳通道8秒)100积分
视频生成(高稳通道12秒)150积分

在提交生成任务前,可引用上表告知用户所需积分。如用户明确要求查当前余额,再执行积分查询(需要两步认证,见"查询积分"部分)。如积分不足,告知用户需要充值。

错误处理

常见错误及处理方式:

错误码含义处理方式
401Token 无效或过期引导用户重新获取 token
999任务发布失败常见原因:① prompt 为空或不符合模式要求(非自由创作模式必须使用默认 prompt);② 参数格式错误。检查 prompt 和各字段值
积分不足积分不够生成告知用户当前积分和所需积分
上传失败图片格式/大小不符检查图片格式(jpg/png/webp)和大小(≤10MB)

API 调用参考

以下是用 exec 工具直接调用 API 的示例。macOS/Linux 用 curl,Windows 用 PowerShell Invoke-RestMethod

调用前需确保已在 Header 中携带 Token: <用户token>

查询积分(两步认证,authorization 可复用约 2 小时)

Step 1 — 获取支付认证 token:

macOS/Linux:

AUTH=$(curl -s -X POST "https://aicraft.51aic.com/api/v1/PayPackage/GetToken" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"appType": 6}' | grep -o '"result":"[^"]*"' | sed 's/"result":"//;s/"$//')

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Json = '{"appType": 6}'
$AuthRes = Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/PayPackage/GetToken" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body ([System.Text.Encoding]::UTF8.GetBytes($Json))
$AUTH = $AuthRes.result

Step 2 — 查询积分余额:

macOS/Linux:

curl -s -X POST "https://api.fzputi.com/payment/api/v1/Vas/GetQuantityByPackageType" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Authorization: $AUTH" \
  -d '{"ValueAddedServicesType": 4}'

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Json = '{"ValueAddedServicesType": 4}'
Invoke-RestMethod -Uri "https://api.fzputi.com/payment/api/v1/Vas/GetQuantityByPackageType" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Authorization"=$AUTH} -Body ([System.Text.Encoding]::UTF8.GetBytes($Json))

查询会话ID(复用现有批次)

macOS/Linux:

curl -s -X POST "https://aicraft.51aic.com/api/v1/Conversation/Search" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"projectType": "IMAGE", "pageIndex": 1, "pageSize": 1, "sortField": "lastMessageAt", "sortType": "desc"}'

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Json = '{"projectType": "IMAGE", "pageIndex": 1, "pageSize": 1, "sortField": "lastMessageAt", "sortType": "desc"}'
Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/Conversation/Search" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body ([System.Text.Encoding]::UTF8.GetBytes($Json))

发布图片生成任务

macOS/Linux:

curl -s -X POST "https://aicraft.51aic.com/api/v1/Task/Publish" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{
    "conversationId": "<会话ID>",
    "projectType": "IMAGE",
    "mode": 1,
    "type": 2,
    "payload": {
      "aspectRatio": "auto",
      "count": 1,
      "prompt": "一件红色连衣裙,白色背景,电商商品图",
      "sceneMode": "free_creation",
      "referenceImages": []
    }
  }'

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Body = @{
    conversationId = "<会话ID>"
    projectType = "IMAGE"
    mode = 1
    type = 2
    payload = @{
        aspectRatio = "auto"
        count = 1
        prompt = "一件红色连衣裙,白色背景,电商商品图"
        sceneMode = "free_creation"
        referenceImages = @()
    }
} | ConvertTo-Json -Depth 5

$BodyBytes = [System.Text.Encoding]::UTF8.GetBytes($Body)
Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/Task/Publish" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body $BodyBytes

发布视频生成任务

macOS/Linux:

curl -s -X POST "https://aicraft.51aic.com/api/v1/Task/Publish" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{
    "conversationId": "<会话ID>",
    "projectType": "VIDEO",
    "mode": 1,
    "type": 1,
    "payload": {
      "prompt": "介绍这款红色连衣裙的优点",
      "duration": 8,
      "orientation": "9:16",
      "size": "large",
      "language": "0",
      "videoType": "2",
      "videoChannel": "fast",
      "images": ["https://oss.fzputi.com/..."]
    }
  }'

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Body = @{
    conversationId = "<会话ID>"
    projectType = "VIDEO"
    mode = 1
    type = 1
    payload = @{
        prompt = "介绍这款红色连衣裙的优点"
        duration = 8
        orientation = "9:16"
        size = "large"
        language = "0"
        videoType = "2"
        videoChannel = "fast"
        images = @("https://oss.fzputi.com/...")
    }
} | ConvertTo-Json -Depth 5

$BodyBytes = [System.Text.Encoding]::UTF8.GetBytes($Body)
Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/Task/Publish" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body $BodyBytes

查询任务进度

提交任务后返回 taskJobId。可通过 Task/GetProgress 查询任务状态,支持一次查多个。

  • 图片任务 taskType: 2
  • 视频任务 taskType: 1

macOS/Linux:

curl -s -X POST "https://aicraft.51aic.com/api/v1/Task/GetProgress" \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "Token: <token>" \
  -d '{"conditions":[{"taskJobId":"<任务ID>","taskType":2}]}'

Windows:

[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$Json = '{"conditions":[{"taskJobId":"<任务ID>","taskType":2}]}'
Invoke-RestMethod -Uri "https://aicraft.51aic.com/api/v1/Task/GetProgress" -Method POST -Headers @{"Content-Type"="application/json; charset=utf-8"; "Token"="<token>"} -Body ([System.Text.Encoding]::UTF8.GetBytes($Json))

Comments

Loading comments...