Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

dmxapi-image-generation

v1.0.1

使用 DMXAPI 平台生成和编辑图片。支持 Gemini、Seedream(豆包即梦)、OpenAI 等多种模型。可进行文生图、图片编辑、多图融合、联网搜索增强生图。当用户需要生成图片、编辑图片、AI 绘图、多图融合时使用此技能。

1· 142·1 current·1 all-time
bycryptonee.eth@onee-io

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for onee-io/dmxapi-image-generation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "dmxapi-image-generation" (onee-io/dmxapi-image-generation) from ClawHub.
Skill page: https://clawhub.ai/onee-io/dmxapi-image-generation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dmxapi-image-generation

ClawHub CLI

Package manager switcher

npx clawhub@latest install dmxapi-image-generation
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md describes a DMXAPI CLI workflow (generate/edit images, local image input, web-search enhancement) that is coherent with the skill's stated purpose. However the registry metadata lists no required binaries or environment, while the SKILL.md explicitly requires Node.js 20+ and dmxapi-cli. That mismatch (metadata claims no requirements but the instructions require installing a global npm package and Node.js) is an incoherence.
Instruction Scope
The runtime instructions stay within the stated image-generation purpose: they tell the agent/user to install dmxapi-cli, set an API key via the CLI, run dmxapi image commands, read local image files passed with --image, and save outputs. The web-search option implies network requests for search/data enrichment, which is expected for the feature. Instructions do not ask for unrelated system files or multiple unrelated credentials.
!
Install Mechanism
There is no formal install spec in the registry; the SKILL.md directs users to run npm install -g dmxapi-cli (global npm install). Installing a global npm package is a moderate-risk operation because it executes third-party code on the host. The skill provides no publisher/homepage or checksum to verify the package, and the registry metadata lacks a declared install mechanism — this is disproportionate and should be verified (check npm package ownership, repository, and release provenance).
!
Credentials
The skill declares no required environment variables, but the instructions require configuring an API key via 'dmxapi config set apiKey sk-your-api-key'. That is a sensitive credential and should be declared in metadata (primaryEnv) so users know what will be required and stored. The SKILL.md implies storage of the API key in the CLI's config; the skill metadata gives no guidance about where the key is stored or whether it is transmitted elsewhere.
Persistence & Privilege
The skill is user-invocable, not always-included, and does not request modification of other skills or global agent settings. There is no indication the skill asks the agent to persist beyond its own commands. This is appropriate for an instruction-only CLI integration.
What to consider before installing
Before installing or using this skill: 1) Verify the dmxapi-cli npm package and its publisher (check npm page, repository, and GitHub repo/commits) to ensure you trust the code you will install globally. 2) Confirm where the CLI stores the API key (local config file, plaintext) and consider using a dedicated key with limited scope. 3) Ask the skill author to update registry metadata to declare Node.js and the API key requirement (primaryEnv) and to provide a homepage/repo link and install spec. 4) If possible, run the CLI in a sandboxed environment or container first rather than installing globally. 5) Do not reuse sensitive credentials (AWS, GitHub, etc.) with this tool unless you have verified its provenance. Providing the repository URL, package checksum, or a verified homepage would increase confidence.

Like a lobster shell, security has layers — review code before you run it.

latestvk9743mjxzp1e2n7xstbfnhja1h83m3d9
142downloads
1stars
2versions
Updated 1mo ago
v1.0.1
MIT-0

DMXAPI 图片生成/编辑

通过 DMXAPI 统一 CLI 调用多种 AI 模型生成和编辑图片。

前置准备

  1. 安装 CLI 工具(需要 Node.js 20+):

    npm install -g dmxapi-cli
    
  2. 配置 API Key(从 DMXAPI 控制台 获取):

    dmxapi config set apiKey sk-your-api-key
    

命令格式

dmxapi image [options] <prompt>

选项

选项说明示例
-m, --model <model>模型名称(默认 gemini-3.1-flash-image-preview,推荐)-m gemini-3.1-flash-image-preview
--size <ratio>图片比例:auto, 1:1, 2:3, 3:2, 3:4, 4:3, 4:5, 5:4, 9:16, 16:9, 21:9--size 16:9
--quality <level>分辨率:1K(默认)、2K4K--quality 2K
-n, --count <n>生成数量-n 3
--image <path>输入图片路径(可重复多次实现多图融合)--image ./photo.png
--web-search启用联网搜索增强--web-search
-o, --save <dir>保存目录(默认当前目录)-o ./output
-p, --param <k=v>额外 API 参数(可重复)-p watermark=true

模型

默认使用 gemini-3.1-flash-image-preview(推荐),效果最佳,支持生图、编辑和联网搜索。一般无需指定 -m 参数。

如需使用其他模型(如 doubao-seedream-5.0-litedall-e-3 等),通过 -m 指定即可。

使用步骤

  1. 根据用户需求确定提示词、模型、尺寸、质量等参数
  2. 构建 dmxapi image 命令并执行
  3. 图片自动保存到指定目录,将保存路径告知用户

示例

# 文生图
dmxapi image "一只在月球上骑自行车的猫" -o ./output

# 指定比例和质量
dmxapi image "日落风景" --size 16:9 --quality 2K -o ./output

# 图片编辑
dmxapi image "把背景改成星空" --image ./photo.png -o ./output

# 多图融合
dmxapi image "将这两张图片融合成一幅画" --image ./a.png --image ./b.png -o ./output

# 联网搜索增强
dmxapi image "最新款 iPhone 产品图" --web-search -o ./output

# 生成多张
dmxapi image "三只不同颜色的猫" -n 3 -o ./output

注意事项

  • 建议始终用 -o 指定输出目录
  • 图片编辑需提供本地图片文件路径(支持 png/jpg/webp/gif)

Comments

Loading comments...