Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Background Remover Claw Skill

Remove backgrounds from AI-generated images in one command. Pass a picture UUID and get back a clean transparent-background image URL.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 26 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (remove backgrounds) match the code and SKILL.md. Required binary (node) and the single env var (NETA_TOKEN) are appropriate for calling the external API at https://api.talesofai.cn to perform image generation and background removal.
Instruction Scope
Runtime instructions and the CLI in bgremove.js are consistent: they instruct the agent to call the remote API and to read NETA_TOKEN from the environment or specific ~/.openclaw/developer .env files. The script only reads those .env files for the token and does not try to read other user files or credentials.
Install Mechanism
No install spec; this is instruction-only with a single JavaScript file and package.json (type: module). No external downloads or archive extraction occur during install.
Credentials
Only one credential (NETA_TOKEN) is required and declared as primaryEnv. That matches the code which uses the token to authenticate to the listed API. The token request is proportionate to the skill's networked functionality.
Persistence & Privilege
always is false and the skill does not modify other skills or system settings. It reads token files from the home directory (to locate the declared credential) but does not persist new privileges or perform privileged system actions.
Assessment
This skill appears coherent and does what it says: it sends images (or image UUIDs) to api.talesofai.cn using the NETA_TOKEN you supply. Before installing: - Confirm you trust the remote service (https://api.talesofai.cn) because your images will be uploaded/processed there. - Use a token scoped only for image processing (avoid reusing high-privilege credentials). - Be aware the script looks for NETA_TOKEN in ~/.openclaw/workspace/.env and ~/developer/clawhouse/.env as a convenience; any sensitive token you place there is accessible to other local processes with file access. - If you need an entirely local/offline background remover, this skill is not appropriate. Otherwise, the skill is internally consistent and proportionate to its purpose.
bgremove.js:27
Environment variable access combined with network send.
!
bgremove.js:18
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk978hja402qea7nep4r5e7aeyx831xna

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

✂️ Clawdis
Binsnode
EnvNETA_TOKEN
Primary envNETA_TOKEN

SKILL.md

Background Remover Claw Skill

Remove backgrounds from AI-generated images in one command.

Usage

node bgremove.js remove <picture_uuid>

Workflow

Works great chained after image-generation-claw-skill:

  1. Generate an image → get a picture_uuid
  2. Run bgremove.js remove <picture_uuid> → get a clean cutout

Output (JSON)

{
  "status": "SUCCESS",
  "url": "https://oss.talesofai.cn/picture/<task_uuid>.webp",
  "task_uuid": "...",
  "source_uuid": "..."
}

Setup

Add your API token to ~/.openclaw/workspace/.env:

NETA_TOKEN=your_token_here

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…