Jimeng-Image-Generater

Use Jimeng AI 4.0 (Volcengine) to generate images from text or image references, and optionally send results to Feishu.

Security Scan

The skill's code mostly matches its described image-generation purpose, but it requests/uses Volcengine credentials that are not declared in the registry metadata and it sends results to a local HTTP endpoint (localhost:18789), which is unexpected and worth caution.

Purpose & Capability

The name/description (Jimeng/Volcengine image generation, optional Feishu delivery) aligns with the scripts: they call visual.volcengineapi.com and perform t2i/i2i tasks. However the registry metadata lists no required environment variables or primary credential while both SKILL.md and scripts require VOLCENGINE_AK and VOLCENGINE_SK — a clear mismatch between claimed metadata and actual requirements.

Instruction Scope

SKILL.md instructs running the included scripts which: (1) use VOLCENGINE_AK and VOLCENGINE_SK to sign API requests to visual.volcengineapi.com; (2) submit and poll jobs and print full JSON responses; (3) when a target is supplied, POST a JSON payload to http://localhost:18789/message containing target, message text, and the image URL. The use of a localhost endpoint is not documented in the metadata and could forward generated URLs or metadata to any local listener — an unexpected externalization path. The instructions do not read other system files, but they do rely on env vars that are not declared in registry metadata.

Install Mechanism

No install spec; skill is instruction + scripts only. No remote downloads, no archive extraction, and included Python/Bash scripts are present. This is low install risk.

Credentials

The scripts legitimately need VOLCENGINE_AK and VOLCENGINE_SK to call Volcengine APIs — that is proportionate to the stated purpose. But the registry metadata did not declare these required env vars or a primary credential, which is an incoherence and security/usability concern. Additionally, the script assumes a local Feishu bridge (localhost:18789) instead of requiring Feishu credentials; this delegates Feishu auth to a local service whose presence and behavior are unknown.

Persistence & Privilege

always:false and no install-time modifications are requested. The skill does not alter other skills or system settings; it only executes included scripts when invoked. No elevated persistence or privileges are requested.

What to consider before installing

This skill appears to be a legitimate wrapper for Volcengine (Jimeng) image generation, but there are two issues you should consider before installing or running it: (1) the scripts require VOLCENGINE_AK and VOLCENGINE_SK (secret credentials) even though the registry metadata did not declare them — verify you trust the skill source before providing keys and prefer an account/key with limited scope and short lifetime; (2) when asked to deliver results to Feishu the script posts a JSON payload to http://localhost:18789/message (a local listener), not directly to Feishu's official API. If you don't already run a trusted local bridge that forwards to Feishu, that localhost endpoint could capture or forward generated image URLs and captions unexpectedly. Recommendations: inspect the scripts (you already have them), confirm the skill author/source, run the skill in an isolated environment (or container) if you must supply real credentials, consider creating an ephemeral/limited Volcengine key, and verify or replace the localhost callback with a delivery mechanism you control. Additional information that would raise confidence: a known homepage or repository, registry metadata corrected to declare required env vars, and an explanation of the expected local Feishu bridge or an option to post directly to Feishu with explicit credentials.

Jimeng AI 4.0 图片生成 Skill

使用火山引擎即梦AI 4.0 生成图片。

环境变量

export VOLCENGINE_AK="你的AccessKeyID"
export VOLCENGINE_SK="你的SecretAccessKey"

使用方式

./jimeng.sh <mode> <prompt> [reference_url] [target] [options]

参数说明

参数	必填	说明
mode	✅	t2i (文生图) 或 i2i (图生图)
prompt	✅	图片描述
reference_url	图生图时可选	参考图片URL，不填则使用默认图片
target	可选	飞书用户ID，如 user:ou_xxx，不填则只输出URL
options	可选	额外选项，如 force_single=true

示例

文生图 (t2i)

# 文生图 - 生成一只可爱的猫咪
./jimeng.sh t2i "一只可爱的猫咪"

# 文生图 - 发送给飞书用户
./jimeng.sh t2i "蓝天白云" "user:ou_5ab7e4d11d7f28bebff34796cc967e24"

# 文生图 + 参考风格图
./jimeng.sh t2i "变成油画风格" "https://example.com/style.jpg"

图生图 (i2i)

# 图生图 - 使用默认参考图（Clawra头像）
./jimeng.sh i2i "戴上墨镜"

# 图生图 - 使用默认参考图
./jimeng.sh i2i "变成卡通风格"

# 图生图 - 自定义参考图
./jimeng.sh i2i "把这张照片变成素描风格" "https://example.com/photo.jpg"

# 图生图 - 发送给飞书用户
./jimeng.sh i2i "戴上牛仔帽" "" "user:ou_xxx"

默认参考图

图生图模式默认使用 Clawra 头像作为参考：

https://cdn.jsdelivr.net/gh/SumeLabs/clawra@main/assets/clawra.png

输出说明

• 直接运行：输出图片URL
• 指定 target：自动发送到飞书

图片格式

• 即梦AI 默认输出 PNG 格式
• URL 后缀是 .image，飞书可以正常发送
• 用户保存：复制链接后把 .image 改成 .png

文件结构

jimeng/
├── SKILL.md      # 本文件
└── scripts/
    ├── sign.py   # 火山引擎签名
    └── jimeng.sh # 主脚本