豆包全家桶(视频图片生成)
v1.0.2使用豆包(火山引擎 Ark)生成图片或视频,将结果保存到本地。当用户提到"豆包生图""豆包图片""豆包生视频""豆包视频""Doubao""Seedance""火山引擎图片""火山引擎视频"时引用。
⭐ 1· 57·0 current·0 all-time
by王新平(Wang-Xin-ping)@showtimewalker
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and runtime instructions: the scripts call the Ark SDK, create/query/delete video tasks, generate/save images, and provide an optional local webhook server. Declared required env vars (ARK_API_KEY, OUTPUT_ROOT) and binaries (uv, python) align with this purpose.
Instruction Scope
Runtime instructions run local Python scripts which read ARK_API_KEY and write outputs/logs/databases under OUTPUT_ROOT (declared). The code optionally reads VIDEO_CALLBACK_BASE_URL (not listed in requires.env) to construct external callback URLs; it also auto-detects a locally running webhook server and generates/uses a .webhook_token file in OUTPUT_ROOT. These behaviors are reasonable for a webhook-based async workflow but are not fully documented in the declared env list.
Install Mechanism
No remote download/install step in the skill bundle. The SKILL.md lists a python dependency (volcengine-python-sdk[ark]) which is appropriate. There are no suspicious external URLs or archive extraction steps in the install metadata.
Credentials
The main secret requested is ARK_API_KEY (primary credential), which is appropriate. OUTPUT_ROOT is used to store outputs, logs, DB, and a webhook token file. The code also checks VIDEO_CALLBACK_BASE_URL (optional) though that variable is not declared as required — if set, it will cause callback URLs (potentially public) to be used. Also note scripts declare requires-python >=3.14 in script headers which may be stricter than typical environments.
Persistence & Privilege
always:false and user-invocable are set (no forced/global installation). The skill writes files under OUTPUT_ROOT and creates a local SQLite DB and .webhook_token for webhook use; it does not alter other skills or global agent config.
Assessment
This skill appears to do what it claims: call the 火山引擎 (Ark) APIs to generate images/videos and save them locally. Before installing, consider the following:
- Keep ARK_API_KEY secret. The skill uses your Ark API key to call the provider; do not share it with untrusted parties.
- OUTPUT_ROOT is where logs, outputs, the webhook DB, and a token file (.webhook_token) will be written — set it to a directory you control (not a system or other application's config directory).
- The skill will optionally use VIDEO_CALLBACK_BASE_URL (if you set it) to construct callback URLs. If you set VIDEO_CALLBACK_BASE_URL to a public endpoint, Ark will POST task callbacks (including task IDs and any returned video_url) to that endpoint — only set this if you trust the target service. If you use the bundled webhook_server, it binds to localhost by default and restricts callbacks to localhost addresses.
- The scripts' header comments require Python >=3.14 and pysdk dependencies; verify your environment can meet that (many systems run older Python). The SKILL.md requires a 'uv' binary and python; ensure those are available.
- The code performs small network checks (e.g., a UDP connect to 8.8.8.8 to detect local IP) and standard HTTP requests to Ark and to fetch/save image/video bytes. This is expected behavior for this use case.
If you need higher assurance, review the included scripts yourself (they are present in the bundle) or run webhook_server in a controlled environment to inspect incoming callbacks before pointing Ark at any publicly reachable endpoint.Like a lobster shell, security has layers — review code before you run it.
latestvk97dje8srf8dytndfg2x5r6cx58465ys
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsuv
Any binpython, python3, py
EnvARK_API_KEY, OUTPUT_ROOT
Primary envARK_API_KEY
