Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Meitu Skills
v1.0.20Comprehensive Meitu AI toolkit for image and video editing. Features include AI poster design, precise background cutout, virtual try-on, e-commerce product...
⭐ 114· 821·3 current·4 all-time
byMeitu.Inc@meituskills
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, required binary (meitu), and required env vars (MEITU_OPENAPI_ACCESS_KEY/SECRET) align with an image/video editing toolkit. However there is an inconsistency: the registry header lists no required config paths, while SKILL.md metadata and many scene SKILL.md files explicitly declare reads/writes to ~/.meitu/credentials.json, ~/.openclaw/workspace/visual/, ./openclaw.yaml, and ./DESIGN.md. That mismatch between published registry metadata and the SKILL.md manifest is worth flagging.
Instruction Scope
The runtime instructions are extensive and mostly focused on Meitu CLI workflows (preflight, prompt assembly, calling meitu commands). They also instruct the agent to read project-local files (openclaw.yaml, DESIGN.md), read/write shared memory under ~/.openclaw/workspace/visual/, and (in project mode) create/update openclaw.yaml and DESIGN.md. Those file reads/writes are legitimate for a 'project mode' feature but broaden the skill's scope beyond a pure one-off image editor — the agent can modify project files and persistent workspace memory. Confirm you want an agent with permission to create/modify those files.
Install Mechanism
This is instruction-only (no install spec). The README suggests manual npm install -g meitu-cli but the skill does not auto-install or download arbitrary code. No remote download URLs or archive extracts are in the skill bundle, which lowers install-time risk.
Credentials
Requested credentials (MEITU_OPENAPI_ACCESS_KEY, MEITU_OPENAPI_SECRET_KEY) and the meitu binary are proportionate to the declared purpose. However the skill also requests read access to a credentials file (~/.meitu/credentials.json) and write access to shared workspace and project files (~/.openclaw/workspace/visual/, ./openclaw.yaml, ./DESIGN.md). Those file-write permissions are more powerful than simple API-key usage and may affect local project state — acceptable for 'project mode' but verify you consent to those writes.
Persistence & Privilege
always:false (no forced global presence). The skill documents writing persistent 'observations' and scene memory to ~/.openclaw/workspace/visual/ and may create or update openclaw.yaml and DESIGN.md in project mode. Autonomous invocation is allowed by default on the platform; combining autonomous invocation with ability to write workspace/project files increases blast radius, so consider disabling autonomous invocation for untrusted skill installs or requiring explicit user confirmation for writes.
What to consider before installing
What to check before installing: 1) Confirm the registry metadata vs SKILL.md mismatch — the package will read ~/.meitu/credentials.json and may read/write ~/.openclaw/workspace/visual/, openclaw.yaml, and DESIGN.md. If you don't want agent-modified project files, do not grant those paths. 2) Prefer supplying MEITU_* keys via environment variables (not a persistent credentials file) and set tight file permissions (chmod 600) if using ~/.meitu/credentials.json. 3) Install meitu-cli only from the official source and verify the 'meitu' binary on PATH (run meitu --version and meitu auth verify). 4) If worried about persistent writes or autonomous actions, disable autonomous invocation or run the skill in an isolated sandbox/container and back up your project files before first use. 5) Review and test with a harmless image and with no openclaw.yaml present to exercise 'one-off' behavior before giving the skill permission to operate in project mode. 6) If you trust the maintainer, ensure the skill's declared permissions in the registry are corrected to match the SKILL.md before broad deployment.Like a lobster shell, security has layers — review code before you run it.
latestvk970vy5serzfgpxjc6mv7rh641843nfj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsmeitu
EnvMEITU_OPENAPI_ACCESS_KEY, MEITU_OPENAPI_SECRET_KEY