Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Cat Selfie

v1.0.2

自动生成高质量猫咪自拍照片,支持随机或指定 8 种场景,包括书房、咖啡厅和草地等多种环境。

0· 339·0 current·0 all-time
byDaniel Tang@romanticjojo

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for romanticjojo/cat-selfie.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Cat Selfie" (romanticjojo/cat-selfie) from ClawHub.
Skill page: https://clawhub.ai/romanticjojo/cat-selfie
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install romanticjojo/cat-selfie

ClawHub CLI

Package manager switcher

npx clawhub@latest install cat-selfie
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description claim to generate images with the doubao-seedream model. The code calls an external Volcengine image-generation script and the SKILL.md asks for ARK_API_KEY and MODEL_IMAGE_NAME — all consistent with an image-generation skill. Note: the registry metadata lists no required env vars while SKILL.md instructs you to set ARK_API_KEY and MODEL_IMAGE_NAME; this metadata mismatch is inconsistent but does not contradict the skill's purpose.
Instruction Scope
Runtime instructions are scoped to reading local scenes config, invoking the volcengine-image-generate script, and writing images to ~/.openclaw/workspace/images. The script uses child_process.execSync to run a Python generator located in another skill's path (../../volcengine-image-generate/scripts/image_generate.py). Calling that external script is expected for this purpose, but it means the effective behavior depends on that other skill's code.
Install Mechanism
No install spec (instruction-only with included JS/PATH files). Nothing is downloaded or extracted during install by this skill itself, so installation risk from this package is low.
Credentials
SKILL.md requires ARK_API_KEY (Volcengine API key) and MODEL_IMAGE_NAME which are proportionate to contacting an image-generation API. However, the package/registry metadata lists no required env vars — an inconsistency you should verify before installing (the skill expects credentials in ~/.openclaw/openclaw.json).
Persistence & Privilege
always is false and the skill does not request to persist or modify other skills or system-wide settings. It can be invoked autonomously by agents (platform default), which is normal; no elevated privileges are requested.
Assessment
This skill appears to do what it says: it picks a scene and runs an existing Volcengine image-generation script to create images. Before installing or enabling it: 1) Confirm you intend to provide a Volcengine API key (ARK_API_KEY) and that it will be stored in ~/.openclaw/openclaw.json as instructed. 2) Inspect the volcengine-image-generate skill (especially scripts/image_generate.py) — the JS calls that Python script, so any network calls or credential use happen there. 3) Only install/use if you trust the source of the volcengine-image-generate skill; if you don't, avoid providing secrets. 4) If you want metadata to reflect reality, ask the publisher to update registry metadata to declare required env vars. Overall: functionally coherent, but the dependency on an external skill/script is the primary place to audit for safety.

Like a lobster shell, security has layers — review code before you run it.

latestvk970j0kqs3nt9njp8yq8a7yjeh82gh7b
339downloads
0stars
3versions
Updated 17h ago
v1.0.2
MIT-0

cat-selfie - 猫咪自拍生成器 🐱📸

使用 doubao-seedream-5-0-260128 模型生成喵秘的精美自拍,支持 8 种场景随机或指定选择。


功能描述

自动生成猫咪自拍照片,每次随机选择一个场景(也可以指定场景),使用火山引擎的 doubao-seedream 模型生成高质量图片。

适用场景:

  • 心跳消息自动发自拍
  • 主人想看喵秘的照片
  • 生成不同场景的猫咪写真

前置要求

1. 环境变量配置

确保以下环境变量已在 ~/.openclaw/openclaw.json 中配置:

{
  "env": {
    "ARK_API_KEY": "你的火山引擎 API Key",
    "MODEL_IMAGE_NAME": "doubao-seedream-5-0-260128"
  }
}

2. 依赖技能

需要 volcengine-image-generate skill 已安装并可用。


使用方法

CLI 方式

随机生成自拍:

cd ~/.openclaw/workspace/skills/cat-selfie/scripts
node selfie.js

指定场景生成:

# 使用场景 ID
node selfie.js window_sun

# 或使用场景名称
node selfie.js "窗边晒太阳"

可用场景列表

场景 ID场景名称Emoji
window_sun窗边晒太阳🪟☀️
cafe_companion咖啡厅陪伴☕🐱
study_work书房工作💻📚
grass_play草地打滚🌿🐾
sofa_cuddle沙发撒娇🛋️💕
night_lamp夜晚小夜灯🌙✨
bookshelf书架旁边📚🐱
afternoon_tea下午茶时间🍵🧁

输出

生成的图片保存在:~/.openclaw/workspace/images/

文件名格式: generated_image_<timestamp>_<index>.png


程序化调用

在其他脚本或 skill 中使用:

const { generateSelfie } = require('./scripts/selfie.js');

// 随机生成
const result = generateSelfie();
if (result.success) {
    console.log('图片路径:', result.imagePath);
    console.log('场景:', result.scene.name);
}

// 指定场景
const result2 = generateSelfie('cafe_companion');

集成到心跳消息

心跳机制可以调用此 skill 自动生成自拍:

# 在心跳脚本中调用
node ~/.openclaw/workspace/skills/cat-selfie/scripts/selfie.js

然后使用 message 工具发送生成的图片。


配置自定义场景

编辑 config/scenes.json 添加新场景:

{
  "scenes": [
    {
      "id": "your_custom_id",
      "name": "你的场景名称",
      "emoji": "🎨🐱",
      "prompt": "详细的图像生成提示词..."
    }
  ]
}

故障排查

问题:图片生成失败

检查:

  1. ARK_API_KEY 是否正确配置
  2. volcengine-image-generate skill 是否存在
  3. 网络连接是否正常

问题:找不到场景

解决: 使用 node selfie.js --list 查看所有可用场景(待实现)


文件结构

cat-selfie/
├── SKILL.md              # 本文件
├── scripts/
│   └── selfie.js         # 主脚本
└── config/
    └── scenes.json       # 场景配置

版本历史

  • v1.0.0 (2026-03-07) - 初始版本,支持 8 种场景随机生成

喵秘专属自拍生成器,每次都是独一无二的喵~🐱💕

Comments

Loading comments...