Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ernie Image Art Name

v0.1.0

名字转艺术字 Skill,使用百度星河社区 ERNIE-Image API 将姓名或文字生成为艺术字图片。This skill should be used when users want to generate artistic text/name images, calligraphy art, styliz...

0· 40·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whisky-12/ernie-image-art-name.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ernie Image Art Name" (whisky-12/ernie-image-art-name) from ClawHub.
Skill page: https://clawhub.ai/whisky-12/ernie-image-art-name
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ernie-image-art-name

ClawHub CLI

Package manager switcher

npx clawhub@latest install ernie-image-art-name
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (generate artistic name images via ERNIE-Image) matches the script behavior: it builds prompts and POSTs to the Baidu ERNIE-Image endpoint. However, the registry metadata claims no required environment variables or credentials while the SKILL.md and script clearly require a Baidu Access Token (AISTUDIO_ACCESS_TOKEN). This mismatch between declared metadata and actual requirements is a coherence issue.
Instruction Scope
SKILL.md stays on-task (collect name/style, require token, call the image API, save results). It does not instruct reading unrelated system files or sending data to unexpected endpoints — the only network call is to https://aistudio.baidu.com/llm/lmapi/v3/images/generations. Minor inconsistency: SKILL.md/README say config.json is in the skill install dir, while the script's top docstring mentions a different path (~/.workbuddy/...). The script itself writes/reads config.json relative to the skill directory.
Install Mechanism
There is no install spec (instruction-only with an included Python script). No external downloads or archive extraction are used. The script uses only the Python standard library.
!
Credentials
The script legitimately needs a single service credential (Baidu AISTUDIO access token) which is proportionate to its purpose. However, the skill registry metadata fails to declare this required environment variable/credential; that omission is suspicious and reduces transparency. The script only reads AISTUDIO_ACCESS_TOKEN (or a CLI-provided token) and no other secrets.
Persistence & Privilege
The skill does create and write a config.json in its own installation directory to store the token if the user asks (--set-token). 'always' is false and the skill does not request system-wide modifications nor edit other skills' configs. The write is limited to the skill's directory.
What to consider before installing
This skill appears to do what it claims (generate artistic name images via Baidu ERNIE-Image) and only contacts Baidu's aistudio endpoint. However: (1) the package metadata does NOT declare the required AISTUDIO_ACCESS_TOKEN even though the SKILL.md and script require it — ask the publisher to fix the metadata or be cautious before supplying your token; (2) the script will save the token to config.json inside the skill directory if you run --set-token, so review where the skill will be installed and whether that storage location is acceptable; (3) confirm the install location and the code (the script is included and small) before running; (4) if you do not trust the skill, do not provide your Access Token and only use a temporary token with limited privileges or run it in an isolated environment. If the publisher can explain and correct the metadata mismatch and the docstring path inconsistency, the concerns would be resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e1txgw9chgqmy8kz138mqfx85msy4
40downloads
0stars
1versions
Updated 1d ago
v0.1.0
MIT-0

名字转艺术字 Skill

功能概述

使用百度星河社区 ERNIE-Image(文心图像大模型)API,将用户提供的姓名或文字生成为高质量的艺术字图片。支持中国风书法、烫金、霓虹、卡通、火焰、冰晶等多种风格。

前置条件

需要百度星河社区 Access Token:前往 https://aistudio.baidu.com/account/accessToken 获取。

执行流程

Step 1:确认 Access Token

优先检查是否已配置,按以下顺序:

  1. 用户本次提供的 Token(命令行 --token
  2. 环境变量 AISTUDIO_ACCESS_TOKEN
  3. 配置文件 config.json(位于 skill 安装目录下)

若 Token 未配置,引导用户通过以下命令保存(只需一次):

python3 scripts/generate_art_name.py --set-token YOUR_TOKEN

Token 获取地址:https://aistudio.baidu.com/account/accessToken

Step 2:确认输入参数

向用户确认:

  • 名字/文字:要生成的内容(必填)
  • 风格:从预设风格中选择(默认中国风)
    • 中国风、烫金、霓虹、卡通、石刻、玫瑰、极简、火焰、冰晶、自定义
  • 输出目录(可选,默认 ./art_names

若用户描述不够具体,主动询问风格偏好。

Step 3:执行生成

调用核心脚本(路径相对于 skill 安装目录):

python3 scripts/generate_art_name.py \
  --name "用户名字" \
  --style 风格名称 \
  --output 输出目录

常用参数:

参数说明
--name / -n要生成的名字或文字(必填)
--style / -s风格:中国风/烫金/霓虹/卡通/石刻/玫瑰/极简/火焰/冰晶/自定义
--prompt / -p自定义描述,配合 --style 自定义 使用
--output / -o图片保存目录
--token / -t临时指定 Access Token
--model / -m模型选择(默认 ERNIE-Image-Turbo)
--set-token将 Token 保存到配置文件(只需一次)
--list-styles查看所有可用风格
--show-config查看当前配置

Step 4:展示结果

脚本成功执行后,生成的图片会保存到本地。使用 open_result_view 展示图片,并询问是否需要调整风格重新生成。

错误处理

错误解决方案
Token 无效 / 401引导用户重新获取 Token 并用 --set-token 保存
网络超时重试,或将 timeout 延长至 180 秒
内容审核拦截调整 Prompt 表达方式,避免敏感词
模型不可用切换为 ERNIE-ImageStable-Diffusion-XL

参考文档

详见 references/api_docs.md:包含完整 API 参数说明、Prompt 写作技巧和代码示例。

配置管理

配置文件 config.json 位于 skill 安装目录下,格式如下:

{
  "access_token": "在这里填写你的 Access Token",
  "model": "ERNIE-Image-Turbo",
  "output_dir": "./art_names"
}

可直接编辑此文件,或用 --set-token 命令更新 Token。

Comments

Loading comments...