Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Kay Image

v1.0.3

AI 图片生成与理解工具 - 支持文生图、图生图、图片理解、视频理解。 基于 KIE AI API,支持 4K 输出、多种宽高比和参考图。 **所需凭证**: 需要 KIE_API_KEY 环境变量(从 https://kie.ai/ 获取)

1· 110·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for papayalove/kay-image.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Kay Image" (papayalove/kay-image) from ClawHub.
Skill page: https://clawhub.ai/papayalove/kay-image
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: KIE_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kay-image

ClawHub CLI

Package manager switcher

npx clawhub@latest install kay-image
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (text→image, image→image, image/video understanding via KIE or LaoZhang) align with the code and CLI options. However, the package metadata declares only KIE_API_KEY as required while the implementation also requires KIE_UNDERSTANDING_API_KEY or LAOZHANG_API_KEY for 'understand' mode. Also the script uses a Bun shebang (#!/usr/bin/env bun) but 'required binaries' lists none — the runtime dependency on Bun is not declared.
Instruction Scope
SKILL.md CLI usage and the script consistently instruct reading local files, accepting remote URLs, and sending data to KIE or LaoZhang APIs — this is expected for the stated purpose. The docs recommend storing API keys in a .env file under skills/kay-image/.env (user-run instruction). Be aware the tool will read local files (fileToBase64) and upload their contents to remote APIs — expected, but sensitive files could be transmitted if provided.
Install Mechanism
No install spec (instruction-only) — low supply-chain risk. However, the script is written for Bun (shebang) and TypeScript; the skill does not declare Bun or any runtime as a required binary. That undeclared runtime requirement may cause failures or hidden assumptions about the environment.
Credentials
Requested credentials (KIE_API_KEY for generation; KIE_UNDERSTANDING_API_KEY or LAOZHANG_API_KEY for understanding) are proportionate to the functionality. Minor inconsistency: metadata frontmatter lists only KIE_API_KEY as required while the code enforces additional environment variables for understanding mode. No unrelated cloud or system credentials are requested.
Persistence & Privilege
The skill is not flagged 'always: true' and does not request system-wide configuration or other skills' credentials. It has no install step that would persist new system services. It does read/write local files only under user-directed paths (output path, optional .env), which is expected for a CLI.
What to consider before installing
This skill appears to implement an image-generation and understanding CLI that calls KIE (and optionally LaoZhang) APIs — that is coherent with its description. Before installing, verify these things: 1) Source and trust: the package has no homepage and the publisher identity is unknown — consider whether you trust the author. 2) Runtime: the script requires Bun (#! /usr/bin/env bun) and is TypeScript; ensure your environment supports Bun or the platform will need to provide it. 3) Credentials: the tool uploads images/videos to remote APIs; only provide an API key with minimal permissions and avoid committing .env files into repos or shared storage. 4) Understanding mode requires either KIE_UNDERSTANDING_API_KEY or LAOZHANG_API_KEY (the metadata only listed KIE_API_KEY) — set these intentionally. 5) Review the full script for any endpoints you don’t recognize and test in a sandbox before running on sensitive files. If you want higher assurance, ask the author for source provenance, an explicit runtime requirement list (Bun/node), and a published homepage or repository for review.
scripts/main.ts:20
Environment variable access combined with network send.
!
scripts/main.ts:16
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
EnvKIE_API_KEY
latestvk97529a29nwnk0wxs8fjr11xm583jqys
110downloads
1stars
4versions
Updated 1mo ago
v1.0.3
MIT-0

Kay Image - AI 图片生成与理解

基于 KIE AI API 的图片生成与理解工具。

⚠️ 必需凭证

使用本工具前,必须配置 API Key:

获取 KIE API Key

  1. 访问 https://kie.ai/
  2. 注册并登录账号
  3. 进入控制台 → API 管理
  4. 创建 API Key 并复制

配置环境变量

export KIE_API_KEY="your-kie-api-key-here"

或在 skill 目录创建 .env 文件:

# 创建 .env 文件
nano skills/kay-image/.env

.env 文件内容:

KIE_API_KEY=your-kie-api-key-here

注意: 没有 API Key 将无法使用本工具的任何功能。


特性

  • 文生图: 根据文本描述生成图片
  • 图生图: 基于参考图进行编辑/变换
  • 图片理解: 分析图片内容(使用 GPT-5/Gemini)
  • 视频理解: 分析视频内容(使用 Gemini)
  • 多分辨率: 支持 1K/2K/4K 输出
  • 多宽高比: 支持 1:1, 3:4, 4:3, 9:16, 16:9, 21:9 等

使用方法

基本文生图

kay-image --prompt "一只可爱的橘猫在草地上玩耍" --output cat.png

指定宽高比和分辨率

kay-image --prompt "上海外滩夜景" --output shanghai.png --ar 16:9 --resolution 2K

图生图

kay-image --prompt "转换成动漫风格" --input https://example.com/photo.jpg --output anime.png

图片理解

kay-image --understand --image https://example.com/photo.jpg --prompt "描述这张图片"

视频理解

kay-image --understand --video https://example.com/video.mp4 --prompt "分析这个视频"

参数说明

参数简写说明默认值
--prompt-p提示词-
--output-o输出路径-
--input-i参考图路径-
--ar-宽高比1:1
--resolution-r分辨率1K
--understand-u理解模式false
--image-图片路径-
--video-视频路径-

环境变量

变量名必需说明
KIE_API_KEY✅ 是KIE AI API 密钥
KIE_UNDERSTANDING_API_KEY❌ 否理解功能 API 密钥(默认使用 KIE_API_KEY)
LAOZHANG_API_KEY❌ 否LaoZhang API 密钥(可选)

价格参考

  • 1K 图片: ~$0.04
  • 2K 图片: ~$0.06
  • 4K 图片: ~$0.09
  • 图片理解: ~$0.005-0.01/张

支持的宽高比

  • 1:1 - 正方形
  • 3:4 - 小红书/Instagram 竖版
  • 4:3 - 标准横版
  • 9:16 - 手机竖屏
  • 16:9 - 宽屏
  • 21:9 - 超宽屏

示例

生成小红书封面

kay-image -p "清新风格护肤品封面,粉色渐变背景" -o cover.png --ar 3:4 -r 2K

生成头像

kay-image -p "动漫风格女生头像,粉色头发" -o avatar.png --ar 1:1

图片风格迁移

kay-image -p "转换成油画风格" -i photo.jpg -o painting.png

OCR 文字提取

kay-image -u --image document.jpg --prompt "提取所有文字"

脚本位置

${SKILL_DIR}/scripts/main.ts


注意事项

  • 视频理解: 仅 Gemini 模型支持
  • 图片格式: 支持 JPG、PNG、WebP
  • 视频格式: 支持 MP4、MOV
  • 文件大小: 建议图片 < 10MB,视频 < 100MB

Comments

Loading comments...