Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Baoyu Imagine

v1.103.0

AI image generation with OpenAI, Azure OpenAI, Google, OpenRouter, DashScope, Z.AI GLM-Image, MiniMax, Jimeng, Seedream and Replicate APIs. Supports text-to-...

⭐ 1· 602·10 current·10 all-time

byJim Liu 宝玉@jimliu

MIT-0

Download zip

LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.

Security Scan

Capability signals

Crypto

These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.

VirusTotal

Benign

View report →

OpenClaw

Benign

high confidence

✓

Purpose & Capability

Name/description match the implementation: the code and SKILL.md implement an image-generation CLI that routes to OpenAI, Google, Azure, OpenRouter, DashScope, Z.AI, MiniMax, Jimeng, Seedream, Replicate, etc. The declared required binaries (bun or npx) align with runtime instructions. The skill does reference many provider-related environment variables in code (API keys, base URLs, model defaults), which is appropriate for a multi-provider image generator; none of those env vars appear unrelated to the stated purpose.

ℹ

Instruction Scope

Runtime instructions explicitly read project/user config files (.baoyu-skills/.../EXTEND.md), may create/write EXTEND.md and .env under ~/.baoyu-skills or a project .baoyu-skills directory, and call the included TypeScript entrypoint (scripts/main.ts). This file I/O and network usage (fetch to provider endpoints) are all expected for this skill, but you should expect the skill to access the listed config paths and to load provider credentials from process.env if present.

✓

Install Mechanism

No remote install spec; code files are bundled in the skill and executed via bun or npx -y bun. There is no suspicious external download or extract step in the install metadata. Running via npx may implicitly fetch runtimes/packages at execution time, which is typical but worth noting.

ℹ

Credentials

The skill references many environment variables for provider credentials and model defaults (OPENAI_API_KEY, GOOGLE_API_KEY, AZURE_OPENAI_API_KEY/AZURE_OPENAI_BASE_URL, REPLICATE_API_TOKEN, DASHSCOPE_API_KEY, ZAI_API_KEY, JIMENG_*, ARK_API_KEY, etc.). These are proportional to a multi-provider image generator. The registry metadata shows no required env vars (none mandatory), which is consistent because credentials are optional and used only when present; however, if you want to use a provider you must supply its API key.

ℹ

Persistence & Privilege

always:false (normal). The skill will create/update EXTEND.md and may write .env-style files under ~/.baoyu-skills or project .baoyu-skills; this is expected for user preferences. Because the skill can be invoked autonomously by default, be aware it could read environment variables and the config paths during autonomous runs — there is no always:true or modification of other skills/configs.

Assessment

This skill appears coherent for its stated purpose, but before installing you should: (1) review and confirm you are comfortable with the skill reading and writing ~/.baoyu-skills and project .baoyu-skills/EXTEND.md (the setup flow will create/modify these files); (2) only provide API keys for providers you intend to use (the code will use many env vars if present); (3) inspect the bundled scripts if you need to confirm there are no unexpected network endpoints — the code calls provider endpoints via fetch, which is expected; (4) ensure you have bun or are willing to run npx -y bun (npx may download runtimes at execution); (5) if you do not want autonomous runs accessing env vars or writing config, restrict skill invocation or disable autonomous invocation; and (6) when in doubt, run the included tests or execute the scripts in a controlled environment first (they are bundled and test files are provided). Overall the package is internally consistent with an image-generation aggregator.

✗

scripts/providers/google.ts:97

Shell command execution detected (child_process).

✗

scripts/providers/azure.test.ts:21