lingjingtest

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill is coherently designed to call JD Cloud JoyCreator, but users should notice that it asks for a JoyCreator App Key and sends prompts or reference image URLs to the provider.

Before installing, be prepared to provide a JoyCreator App Key and to send prompts or public reference-image URLs to JD Cloud JoyCreator. Use a dedicated/revocable key, avoid sensitive media or prompts, and confirm each generation job before submission because it may consume account credits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may route relevant creative-generation requests through this skill and its external API workflow.

Why it was flagged

This broadly instructs the agent to invoke the skill for many image/video-generation phrases. It is aligned with the stated purpose, but users should know the skill may be selected automatically for those requests.

Skill content
当用户提到灵境、JoyCreator、豆包、海螺、可灵、拍我、文生图、文生视频、图生视频、AI绘图、AI视频生成、想画图、想做视频时,必须使用此 skill。
Recommendation

Keep final user confirmation before submitting generation jobs, especially where credits, billing, or external sharing may be involved.

What this means

Whoever uses the key can submit JoyCreator generation tasks under that account, which may affect account usage or billing.

Why it was flagged

The skill requires a JoyCreator App Key and uses it as a bearer credential for API calls. This is expected for the integration, but the registry metadata lists no primary credential or required environment variable.

Skill content
请提供您的 JoyCreator App Key ... Authorization: Bearer <app_key>
Recommendation

Use a dedicated, revocable, least-privileged JoyCreator key where possible; prefer the JOYCREATOR_APP_KEY environment variable and do not hardcode or share the key.

What this means

Creative prompts and reference media URLs may be disclosed to the external JoyCreator service as part of normal operation.

Why it was flagged

The workflow sends the user's prompt and any mapped generation parameters to the JD Cloud JoyCreator endpoint. Reference-image workflows also require public image URLs.

Skill content
POST https://model.jdcloud.com/joycreator/openApi/submitTask ... "prompt": "<阶段一提炼的 core_prompt>"
Recommendation

Avoid submitting sensitive prompts or private images unless you are comfortable sending them to JD Cloud JoyCreator and the referenced model providers.