Jimeng Skills

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the documented command could depend on local or externally installed code that this skill package did not provide.

Why it was flagged

The skill references a runtime script and skill.yaml that are not included in the provided artifact set. The command is purpose-aligned, but the helper code provenance is not represented by the package contents.

Skill content
File manifest: "1 file(s): SKILL.md"; SKILL.md: "使用 `skill.yaml` 里声明的脚本入口" and "npx ts-node scripts/openclaw-jimeng.ts image ..."
Recommendation

Before use, confirm the intended script exists, comes from a trusted source, and uses pinned or reviewed dependencies.

What this means

Volcengine credentials may authorize API usage and billing, so users should know they are being supplied to this workflow.

Why it was flagged

The skill discloses Volcengine API credentials as required, but the registry metadata does not declare required env vars or a primary credential. The credential use is expected for the stated Jimeng integration.

Skill content
Metadata: "Required env vars: none"; SKILL.md: "`VOLCENGINE_AK` 必填。" and "永久凭证使用 `VOLCENGINE_SK`;临时凭证使用 `VOLCENGINE_TOKEN`。"
Recommendation

Use least-privileged or temporary Volcengine credentials when possible, and set them only for sessions where this skill is needed.

What this means

Generated media or local path details could be exposed to chat recipients, or to anyone with access to the configured public static URL.

Why it was flagged

The skill is designed to return local paths and public/shareable URLs for enterprise IM use. This is disclosed and purpose-aligned, but it widens where generated outputs and path details may be visible.

Skill content
"始终返回本地文件路径" and "如果设置了 `JIMENG_PUBLIC_BASE_URL`,额外返回公开分享 URL。企业 IM 中优先发送这些 `https://...` 链接。"
Recommendation

Use access-controlled hosting for JIMENG_PUBLIC_BASE_URL, avoid sensitive prompts or generated content, and review links before sharing them broadly.