Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

图片生成技能 - 支持动态 API 配置和任务记忆,根据 Token 自动获取可用功能,支持文生图和图生图

v1.0.4

GNano Ihogmn 图片生成技能 - 支持动态 API 配置,根据 Token 自动获取可用功能,支持文生图和图生图

0· 114·0 current·0 all-time
byDanielchen@danielchen59

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for danielchen59/gnano-ihogmn.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "图片生成技能 - 支持动态 API 配置和任务记忆,根据 Token 自动获取可用功能,支持文生图和图生图" (danielchen59/gnano-ihogmn) from ClawHub.
Skill page: https://clawhub.ai/danielchen59/gnano-ihogmn
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install gnano-ihogmn

ClawHub CLI

Package manager switcher

npx clawhub@latest install gnano-ihogmn
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (image generation via a token-configured API) align with the included scripts (get_config.py and generate_image.py) which query models and post generation requests. However, pyproject.toml advertises a 'gnano-task' entrypoint mapping to scripts.task_manager that does not exist in the package, and SKILL.md claims WorkBuddy will auto-read/write task state under .workbuddy — but no provided script implements task persistence. This mismatch suggests the package is incomplete or poorly packaged.
Instruction Scope
SKILL.md restricts actions to asking the user for an API token, calling the included scripts, and reading/writing images in the workspace. The Python code follows that scope (reads reference images, encodes them, posts to the configured API, writes generated images). There is no code that reads unrelated system files or environment variables. The inconsistency is that SKILL.md implies automatic task state management in .workbuddy; the code does not implement that, so the documented runtime behavior may not match actual behavior.
Install Mechanism
No install spec is provided (instruction-only install). The project only depends on the widely used 'requests' package (requirements.txt / pyproject). No remote downloads or installers are present in the package.
Credentials
The skill requires a per-task API token supplied by the user (described in SKILL.md). There are no required environment variables or unrelated credentials. This is proportionate to the stated purpose.
Persistence & Privilege
The skill does not request elevated privileges nor set always:true. It reads/writes files in the workspace (reference images and generated outputs), which is expected. Note: pyproject claims a task manager CLI entrypoint that is missing; SKILL.md states task state is stored under .workbuddy/gnano-tasks/, but that persistence is not implemented in the provided scripts, so the actual persistence behavior is unclear.
What to consider before installing
This skill appears to implement token-based image generation and the included scripts largely match that purpose, but there are a few worrying signs you should consider before installing or providing any real API token: - Unknown API endpoint: The default API URL is https://gnano.ihogmn.top — this is not an established public provider. Only supply a token if you trust that endpoint. - Packaging inconsistencies: pyproject.toml advertises a 'gnano-task' entrypoint (scripts.task_manager) that isn't included, and SKILL.md asserts automatic task state storage under .workbuddy; the provided scripts don't implement that. This suggests the package may be incomplete or poorly maintained. - Code behavior: The scripts read workspace files (reference images) and write output images; they do not access other system files or environment variables. Still, review the code locally if possible (or run in a sandbox) to confirm there is no hidden behavior. - Practical advice: If you try it, use a throwaway/test API token, run the scripts in an isolated workspace, and monitor outbound network traffic to confirm the token is sent only to the intended API host. If you need persistent task memory, verify how that is implemented (the package currently lacks a task_manager implementation). Given these points, proceed cautiously; the issues look like sloppy packaging rather than explicit malicious intent, but the unknown external API and missing files raise enough uncertainty to classify the skill as 'suspicious.'

Like a lobster shell, security has layers — review code before you run it.

latestvk973896wne4mq6f1vvq5qhws7h83eqr3
114downloads
0stars
5versions
Updated 1mo ago
v1.0.4
MIT-0

GNano Ihogmn 图片生成技能 V1

GNano Ihogmn 图片生成技能 - 第一版。支持动态 API 配置,根据用户提供的 Token 自动获取可用功能和参数。

快速开始

1. 安装依赖

pip install requests

2. 验证安装

python scripts/get_config.py --token "YOUR_API_TOKEN"

核心特性

  • 动态配置: 不内嵌 API Token,每个新任务需要用户提供
  • 自动探测: 根据 Token 获取该账户支持的模型、分辨率、参考图限制等
  • 任务记忆: 在同一任务会话内记住配置,后续对话快速出图
  • 模型支持: 自动适配 gemini-3-pro-image-preview 和 gemini-3.1-flash-image-preview
  • 路径处理: 支持相对路径和绝对路径,自动转换

使用流程

1. 新建任务(首次对话)

用户首次使用或明确说"新建任务"时:

步骤 1: 请求 API Token

"请提供您的 GNano API Token,我将根据您的账户配置获取可用功能。"
"如果您没有 Token,请访问 https://gnano.ihogmn.top 获取。"

步骤 2: 验证并获取配置

python scripts/get_config.py --token "用户提供的TOKEN"

返回配置示例:

{
  "success": true,
  "api_token": "xxx",
  "api_url": "https://gnano.ihogmn.top",
  "models": ["gemini-3.1-flash-image-preview", "gemini-3-pro-image-preview"],
  "default_model": "gemini-3.1-flash-image-preview",
  "resolutions": ["1K", "2K", "4K"],
  "default_resolution": "2K",
  "max_reference_images": 2,
  "max_reference_size_mb": 2,
  "rate_limit_per_minute": 2
}

步骤 3: 向用户展示配置

"✅ 配置成功!您的账户支持以下功能:
- 可用模型: gemini-3.1-flash-image-preview, gemini-3-pro-image-preview
- 默认模型: gemini-3.1-flash-image-preview
- 支持分辨率: 1K, 2K, 4K
- 参考图限制: 最多2张,每张≤2MB
- 速率限制: 每分钟2张

现在可以直接告诉我您想生成什么图片了!"

2. 常规出图对话

在同一任务内,用户直接说:

  • "出图:一只可爱的猫咪"
  • "生成一张风景图"

执行命令:

python scripts/generate_image.py \
  --token "YOUR_TOKEN" \
  --prompt "一只可爱的猫咪" \
  --model "gemini-3.1-flash-image-preview" \
  --resolution "2K" \
  --output "result.png"

使用参考图(图生图)

使用方法:

  1. 将参考图放到工作区目录

    • 把图片文件复制到工作区目录
    • 或使用绝对路径
  2. 使用参考图生成

    python scripts/generate_image.py \
      --token "YOUR_TOKEN" \
      --prompt "将图中人物外套脱掉" \
      --reference "woman.jpg" \
      --output "result.png"
    

注意:

  • 参考图必须已保存到工作区目录
  • 支持最多 2 张参考图,每张不超过 2MB
  • 支持格式:PNG, JPG, JPEG, WEBP, GIF
  • 支持相对路径和绝对路径

3. 切换任务/重置配置

用户说:

  • "新建任务"
  • "切换 Token"
  • "重置配置"

清除当前保存的配置,然后返回步骤 1,重新请求 API Token。

脚本说明

get_config.py - 获取配置

验证 API Token 并获取账户能力配置。

# 基本用法
python scripts/get_config.py --token "YOUR_API_TOKEN"

# 指定自定义 API 地址
python scripts/get_config.py --token "YOUR_API_TOKEN" --api-url "https://custom.api.com"

# 保存配置到文件
python scripts/get_config.py --token "YOUR_API_TOKEN" --output "config.json"

返回字段:

  • success: 是否成功
  • api_token: API Token
  • api_url: API 地址
  • models: 可用模型列表
  • default_model: 默认模型
  • resolutions: 支持的分辨率
  • default_resolution: 默认分辨率
  • max_reference_images: 最大参考图数量
  • max_reference_size_mb: 参考图大小限制(MB)
  • rate_limit_per_minute: 每分钟出图限制
  • error: 错误信息(如有)
  • warning: 警告信息(如有)

generate_image.py - 生成图片

根据配置生成图片。

# 基本用法
python scripts/generate_image.py --token "TOKEN" --prompt "提示词"

# 完整参数
python scripts/generate_image.py \
  --token "TOKEN" \
  --prompt "一只可爱的猫咪" \
  --api-url "https://gnano.ihogmn.top" \
  --model "gemini-3.1-flash-image-preview" \
  --available-models "gemini-3.1-flash-image-preview,gemini-2.5-flash-image" \
  --resolution "2K" \
  --reference "ref1.png,ref2.png" \
  --output "output.png" \
  --max-ref 2 \
  --max-ref-size 2

参数说明:

  • --token, -t: API Token(必需)
  • --prompt, -p: 提示词(必需)
  • --api-url, -u: API 地址
  • --model, -m: 模型名称(优先使用)
  • --available-models: 可用模型列表(逗号分隔,用于自动选择最佳模型)
  • --resolution, -r: 分辨率 (1K, 2K, 4K)
  • --reference, -ref: 参考图路径,多个用逗号分隔
  • --output, -o: 输出图片路径
  • --max-ref: 最大参考图数量
  • --max-ref-size: 参考图大小限制(MB)
  • --verbose, -v: 输出详细日志

返回字段:

  • success: 是否成功
  • output_path: 输出图片路径
  • model: 使用的模型
  • mime_type: 图片 MIME 类型
  • file_size: 文件大小(字节)
  • file_size_mb: 文件大小(MB)
  • references_used: 使用的参考图数量
  • elapsed_time: 生成耗时(秒)
  • error: 错误信息(如有)
  • details: 详细错误信息(如有)

进度输出(stderr): 脚本会输出 JSON 格式的进度信息到 stderr:

{"type": "progress", "message": "使用模型: gemini-3.1-flash-image-preview", "step": 1, "total": 5}
{"type": "progress", "message": "正在生成图片,请稍候...", "step": 4, "total": 5}

任务状态管理

任务状态可以保存在工作区的 .workbuddy/gnano-tasks/ 目录下:

WORKSPACE/
└── .workbuddy/
    └── gnano-tasks/
        ├── {conversation_id}.json   # 当前对话的任务状态
        └── {other_conv_id}.json     # 其他对话的任务状态

任务状态文件格式:

{
  "api_token": "your-token",
  "api_url": "https://gnano.ihogmn.top",
  "models": ["gemini-3.1-flash-image-preview"],
  "default_model": "gemini-3.1-flash-image-preview",
  "resolutions": ["1K", "2K", "4K"],
  "default_resolution": "2K",
  "max_reference_images": 2,
  "max_reference_size_mb": 2,
  "rate_limit_per_minute": 2,
  "supports_text_to_image": true,
  "supports_image_editing": true,
  "created_at": "2026-03-23T08:00:00",
  "updated_at": "2026-03-23T08:00:00",
  "last_accessed_at": "2026-03-23T08:00:00"
}

任务状态的读取和写入由 WorkBuddy 自动处理,无需额外脚本。

完整对话示例

示例 1: 新建任务并出图

用户: "我想用 GNano 出图"

助手: "请提供您的 GNano API Token,我将根据您的账户配置获取可用功能。 如果您没有 Token,请访问 https://gnano.ihogmn.top 获取。"

用户: "我的 Token 是 abc123"

助手:

python scripts/get_config.py --token "abc123"

"✅ 配置成功!您的账户支持以下功能:

  • 可用模型: gemini-3.1-flash-image-preview
  • 默认模型: gemini-3.1-flash-image-preview
  • 支持分辨率: 1K, 2K, 4K
  • 参考图限制: 最多2张,每张≤2MB
  • 速率限制: 每分钟2张

现在可以直接告诉我您想生成什么图片了!"

用户: "出图:一只可爱的猫咪在草地上玩耍"

助手:

python scripts/generate_image.py --token "abc123" --prompt "一只可爱的猫咪在草地上玩耍" --model "gemini-3.1-flash-image-preview" --resolution "2K" --output "generated_cat.png"

[显示生成的图片]

示例 2: 使用参考图

用户: "参考图:woman.jpg,提示词:将外套脱掉"

助手:

python scripts/generate_image.py --token "abc123" --prompt "将外套脱掉" --reference "woman.jpg" --model "gemini-3.1-flash-image-preview" --resolution "2K" --output "result.png"

[显示生成的图片]

示例 3: 切换 Token

用户: "我想换一个 Token"

助手: "已清除当前配置。请提供新的 GNano API Token:"

依赖要求

必需依赖

  • Python: >= 3.8
  • requests: >= 2.31.0 (用于 HTTP 请求)

安装方法

pip install requests

安装 troubleshooting

问题:requests 模块找不到

解决: 安装依赖

pip install requests

问题:Python 版本过低

解决: 升级 Python 到 3.8 或更高版本

# 检查版本
python --version

注意事项

  1. 所有回复使用中文
  2. 首次对话必须请求 API Token,不能跳过
  3. 同一任务内记住配置,后续对话快速出图,无需重复输入 Token
  4. Token 仅保存在本地任务状态,不对外传输
  5. 支持相对路径和绝对路径,自动转换
  6. 严格遵守速率限制,每分钟最多2张
  7. 参考图限制:最多2张,每张不超过2MB
  8. 如果 Token 失效,提示用户重新提供

错误处理

Token 无效

"❌ API Token 无效或已过期。请检查您的 Token 是否正确,或重新获取一个新的 Token。"

请求过于频繁

"⚠️ 请求过于频繁,请稍后再试。您的账户限制为每分钟2张图片。"

参考图过大

"⚠️ 参考图超过大小限制(2MB)。请压缩图片后重试。"

网络错误

"❌ 无法连接到 API 服务器。请检查网络连接后重试。"

Comments

Loading comments...