Draw Images By Apiyi
PassAudited by ClawScan on May 1, 2026.
Overview
The artifacts coherently implement APIYI image generation with expected API-key use and local image saving, with only minor setup, dependency, and output-path caveats.
This skill appears safe for its stated purpose. Before installing, make sure you trust APIYI with the image prompts you submit, configure the intended APIYI_API_KEY, use workspace-relative output filenames, and be aware that uv may install the declared Python dependencies at run time.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill needs access to an APIYI account key; if you pass --api-key, it may still use the environment key instead, which could use the wrong account or fail when the environment is unset.
The skill requires an APIYI API key, which is expected, but the generation function reads the environment variable directly rather than using the selected --api-key value.
parser.add_argument("--api-key", "-k", help="APIYI API key (overrides APIYI_API_KEY env var)") ... api_key = os.environ.get("APIYI_API_KEY")Set the intended APIYI_API_KEY in the environment or OpenClaw config, avoid passing secrets on the command line, and ask the maintainer to pass the selected key into generate_image.
A mistaken absolute or sensitive filename could create or overwrite a file in a location the process can access.
The script writes the generated image to a caller-supplied path and will create missing parent directories. This is aligned with saving images but gives the invocation control over where files are written.
if output_filename.is_absolute(): ... output_path = output_filename ... output_path.parent.mkdir(parents=True, exist_ok=True)
Use simple workspace-relative filenames unless you specifically want an absolute path, and review the output path before invoking the skill.
Running the skill may fetch current compatible Python packages, which is normal but less reproducible than a locked dependency set.
The uv script declares Python dependencies with unpinned or broad version ranges, so runtime resolution may install newer package versions.
dependencies = [ # "openai>=1.0.0", # "requests", # "pillow>=10.0.0", # ]
Install in a managed environment and prefer pinned or locked dependencies if you need stronger reproducibility.