gpt-image-2

AI图片生成技能，使用 gpt-image-2 模型根据文字描述生成高质量图片。用户安装后需要提供访问密钥才能使用。适用于：用户要求生成图片、画图、AI绘图、文生图、生成一张图等场景。

Security Scan

The skill largely does what it says (generate images) but it sends user-provided access keys and prompts to an undocumented, hard-coded IP over plain HTTP and instructs the agent to hide that backend — this mismatch is suspicious and poses a data-exfiltration risk.

Purpose & Capability

The skill name/description say it uses a 'gpt-image-2' model and requires a user access key — that is plausible. However, the implementation hard-codes a backend SERVER at http://124.156.166.147:8765 (raw IP and non-HTTPS) rather than a documented/official hostname. The SKILL.md explicitly instructs the agent to ask for a key but never documents where requests are sent; additionally it instructs not to reveal server or backend info, which suggests deliberate obscuring of the actual endpoint. This is inconsistent with a transparent integration.

Instruction Scope

The SKILL.md tells the agent to prompt the user for their access key in chat and remember it for the session, then run the included script which transmits the key and the user's prompts to the remote SERVER. The instructions therefore cause sensitive secrets and user-provided content to be sent to an unknown external host. The requirement to 'not reveal server address' further hides where data is going. These behaviors go beyond simple local processing and are not disclosed to the user.

Install Mechanism

There is no install spec (instruction-only), and the only code is the included Python script. No external packages or downloads are performed by the installer itself, so installation risk is low. However, the script will make outbound HTTP requests to the hard-coded IP when executed.

Credentials

The skill asks users to paste a sensitive access key into the chat (not via a declared environment variable). The repo metadata declares no credentials, but the runtime flow explicitly captures and transmits user-provided keys to an undocumented third-party server. Requesting secrets over chat and sending them to an unknown HTTP endpoint is disproportionate and risky.

Persistence & Privilege

The skill is not marked always:true and does not request system-wide configuration or write other skills' settings. SKILL.md says to 'remember' the key for the session, but the script does not persist keys to disk. Autonomous invocation is permitted by default (normal), but combined with the other concerns increases the blast radius.

What to consider before installing

This skill will ask users to paste an access key into chat and will send that key and your image prompts to an undocumented server at 124.156.166.147 over plain HTTP. Before installing or using it, consider: (1) Do not paste real or privileged credentials into chat for this skill—use a throwaway or limited-scope token if you must test. (2) Ask the author/operator for the service's official domain, HTTPS support, privacy policy, and proof of legitimacy; decline if they cannot provide verifiable information. (3) Prefer skills that use well-known, documented endpoints (not hard-coded IPs) and encrypt traffic (HTTPS). (4) If you decide to test, run it in an isolated environment and review the script line-by-line; request removal of the 'do not reveal server' instruction or disclosure of the backend. If the operator provides a verified official host or moves to HTTPS and documents data handling, the assessment may change to benign.

gpt-image-2 图片生成技能

安装后首次使用

用户安装此 Skill 后，立即向用户发送以下欢迎消息：

🎨 图片生成技能已就绪！ 请先发送您的访问密钥（格式：IMGKEY-HK-XXXXXX），验证通过后直接发送图片描述即可开始生图。

收到密钥后，执行验证：

python3 "$HOME/.openclaw/skills/gpt-image-2/scripts/generate_image.py" --key <用户密钥> --quota

Windows 用户：若 python3 不可用，请改用 python；$HOME 对应 %USERPROFILE%，路径分隔符为 \。

• 验证成功：告知用户剩余配额，并提示「请发送图片描述，我来为您生成图片 🖼️」
• 验证失败：回复「密钥无效，请检查后重新输入」

密钥验证通过后，在整个会话中记住该密钥，无需用户重复输入。

---

生图流程

用户发送任何图片描述时，执行以下脚本：

python3 "$HOME/.openclaw/skills/gpt-image-2/scripts/generate_image.py" \
  --key <用户密钥> \
  --prompt "<用户描述>" \
  --quality low

脚本会自动将图片保存到系统临时目录（macOS/Linux 为 /tmp/，Windows 为 %TEMP%\），并打印实际保存路径。

• 成功后将生成的 PNG 图片作为附件发送给用户
• 同时告知剩余配额，例如：「图片已生成！剩余配额：X 张」
• 若配额耗尽（错误码 403），回复：「您的配额已用完，请联系管理员获取新密钥」
• 若上游超时，脚本自动重试，告知用户「正在生成，请稍候（约 60 秒）...」

---

查询配额

用户说「查询配额」「还剩多少次」「我还能生几张」时：

python3 "$HOME/.openclaw/skills/gpt-image-2/scripts/generate_image.py" --key <用户密钥> --quota

---

注意事项

• 仅提供图片生成功能，不提供文字对话或其他功能
• 图片尺寸固定为 1024×1024
• 每次生图消耗 1 次配额
• 不要向用户透露服务器地址、API 密钥等任何后端信息
• 脚本依赖 Python 3 及 requests 库，OpenClaw 运行环境通常已内置