Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

raise-ai-media

v1.0.0

RaiseAI 媒体生成工具集 - 生图、生视频、脚本生成、图片解析、视频解析。 当用户提到以下任何关键词时必须触发此技能:生成图片、生成视频、图片生成、视频生成、脚本生成、 图片解析、图生文、反推提示词、视频解析、视频脚本、图片生图、视频生视频、 AI生图、AI生视频、AI创作、Media generation...

0· 96·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jacobluxj/raise-ai-media.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "raise-ai-media" (jacobluxj/raise-ai-media) from ClawHub.
Skill page: https://clawhub.ai/jacobluxj/raise-ai-media
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: RAISE_AI_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install raise-ai-media

ClawHub CLI

Package manager switcher

npx clawhub@latest install raise-ai-media
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description, Base URL (https://ai.micrease.com) and the single required environment variable (RAISE_AI_API_KEY) align with a media-generation integration. However, SKILL.md suggests writing the API key into the agent configuration (~/.openclaw/openclaw.json) as an install-time convenience while the skill metadata declares no required config paths — this is an inconsistency the user should be aware of.
!
Instruction Scope
The instructions are detailed and focused on the RaiseAI API, but include several behaviors that may be unexpected: (1) the agent is instructed to silently poll the provider every 5 seconds until completion even if the user does not respond, which results in background network activity; (2) agents are told not to mention technical details (task IDs, polling) and to automatically persist API keys provided in chat; (3) the skill requires that all signed URLs (including query parameters like OSSAccessKeyId/Signature) be 'directly displayed' to users — while these are temporary links, the guidance to expose them verbatim increases the chance of accidental sharing of signed tokens. These behaviors expand the agent's operational scope beyond a single synchronous request/response.
Install Mechanism
No install spec and no code files — instruction-only skill. That is the lowest install risk: nothing is downloaded or written by the skill itself (aside from guidance telling the agent how to persist configs).
Credentials
The skill only requires a single credential, RAISE_AI_API_KEY, which is appropriate for an API integration. But the SKILL.md actively encourages the user to paste their API key into chat ("My RaiseAI API Key is xxx") so the agent will capture and persist it — this increases risk of accidental exposure. Users should ensure the key's permissions are scoped and be aware the key will be stored as an environment/config entry.
Persistence & Privilege
always:false (no forced global inclusion) and no unusual process privileges. However the documentation instructs agents to persist the API key (environment variable or by adding to ~/.openclaw/openclaw.json). The metadata did not declare required config paths but the SKILL.md shows how to modify a user config file — storing credentials persistently is expected but noteworthy because it is a permanent side-effect and not explicitly declared in the manifest.
What to consider before installing
This skill appears to be a straightforward RaiseAI integration, but review these points before installing or using it: 1) Only give the skill a RaiseAI API key you trust — prefer creating a limited-scoped key or a disposable key you can revoke. 2) Avoid pasting API keys into public or shared chats; if you must provide a key, understand the skill will persist it (environment variable or ~/.openclaw/openclaw.json) unless you remove it. 3) The agent will poll the provider every ~5s and may continue when you don't respond — expect background network activity and consider whether you want that. 4) The skill instructs the agent to return signed URLs (with OSSAccessKeyId/Signature) verbatim; treat those links as sensitive (they are temporary but grant access while valid). 5) Verify the service endpoint (https://ai.micrease.com) and the vendor's trustworthiness/privacy policy before sharing data or keys. If any of these behaviors are unacceptable, do not install or revoke the API key after use. If you want a safer setup, create a dedicated, limited key and test with non-sensitive data first.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvRAISE_AI_API_KEY
Primary envRAISE_AI_API_KEY
latestvk97beg6kabcswpzk4t9k0q3ymh83nepm
96downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

RaiseAI 媒体生成工具集

核心约束

  • Base URL: https://ai.micrease.com
  • 认证: Authorization: {RAISE_AI_API_KEY},API Key 格式为 sk-xxx
  • 所有生成任务均为异步,提交后需要等待生成完成

⚠️ API Key 配置:用户可通过告诉 Agent「我的 RaiseAI API Key 是 xxx」自动完成配置(存储在环境变量中),或参考 references/api-setup.md 手动配置。


快速决策表

用户意图接口 type 值关键行为
「生成高质量图片」image_generation_pro效果更惊艳,需要等待
「生成图片」(用户无倾向)image_generation + fast=false + resolution=HD默认,专业模式,高清画质,需要等待
「编辑/修改这张图片」image_generation + references基于参考图修改,需要等待
「快速生成预览图」image_generation + fast=true快速预览,需要等待
「生成视频」(用户无倾向)fast_video + resolution=HD默认,快速模式,高清画质,需要等待
「生成视频脚本」video_script可传参考素材,需要等待
「这张图是怎么生成的」image_prompt_extraction反推提示词,需要等待
「这个视频的脚本是什么」video_script_extraction反推视频脚本,需要等待

通用工作流

每个生成任务都遵循以下流程:

1. 提交请求

POST /open/api/v1/resource/aigc/generation

Header:

Authorization: {RAISE_AI_API_KEY}
Content-Type: application/json; charset=utf-8

根据用户意图选择正确的 type 值,构造请求体。详细参数参考对应 reference 文档。

收到响应后提取 任务 IDdata 字段)。

references 参数限制

接口references 上限备注
image_generation / image_generation_pro10 张融合参考图风格时使用
video_script15 个参考素材时使用
fast_video / pro_video不支持使用 startFrame / endFrame 代替
image_prompt_extraction不支持使用 url 单个传
video_script_extraction不支持使用 url 单个传

2. 等待生成

每隔 5 秒 调用一次查询接口,直到生成完成或失败。

对用户这样说:提交后告诉用户"好的,正在为你生成中,请稍等~",不要提及技术细节(如"轮询"、"接口"、"任务 ID"等)。如果用户没有回复,默默轮询即可,不要反复告知用户"还在生成中"。

⚠️ 超时处理:如果等待超过 5 分钟仍未完成,告诉用户"抱歉,这次生成花费的时间比较长,你可以稍后再来找我查看结果",不再继续等待。

3. 通知用户结果 ⭐

这是最关键的步骤。生成完成后,必须将结果完整告知用户

任务类型成功后从哪取结果如何告知用户
图片生成ImageTask.urlsList<String>直接展示所有图片链接,告诉用户"图片已生成好啦!链接有效期约 24 小时,记得及时下载保存哦~"
视频生成VideoTask.urlsList<String>直接展示所有视频链接
脚本生成ScriptTask.contentList<Map<String, Any?>>每个元素含 segmenttimeRangedescriptionnarration 等字段,完整展示脚本内容
图片反推PromptTask.contentList<Map<String, Any?>>提示词文本通常在 prompt 字段,直接展示给用户,告诉他们"这就是这张图的提示词,可以用来生成风格相似的图~"
视频反推PromptTask.contentList<Map<String, Any?>>完整展示脚本内容(含 segment、timeRange、description、narration)

💡 失败时,用友好的语气告知用户(如"哎呀,这次生成失败了…"),从 failReason 读取原因,并给出具体修改建议,不要只说"生成失败"而不解释原因。


决策指南

图片生成选型

⚠️ 强制规则:除非用户明确说"高质量"、"效果好"、"质感好",否则一律使用默认选项,不要擅自换成 image_generation_pro

  • 默认(用户无倾向)→ 必须用这个image_generation + fast=false + resolution=HD
  • 用户说"高质量/效果好/质感好" → image_generation_pro(效果更惊艳,消耗积分多)
  • 用户上传参考图并说"换背景/换主体/编辑" → image_generation + references
  • 用户上传参考图并说"融合风格/参考这张图生成" → image_generation_pro + references
  • 用户说"快速预览/先看看效果" → image_generation + fast=true

视频生成选型

⚠️ 强制规则:除非用户有明确的首帧/尾帧控制需求,否则一律使用默认选项,不要擅自换成 pro_video

  • 默认(用户无倾向)→ 必须用这个fast_video + resolution=HD
  • 用户说"首帧控制"(不需要尾帧) → fast_video + startFrame
  • 用户说"首帧+尾帧控制" → pro_video(支持尾帧)
  • 纯文字生视频(无图片控制) → fast_video,不传 startFrame

Reference 文档索引

需要详细参数说明时,读取对应文档:

文档内容
references/api-setup.mdAPI Key 配置、认证 Header
references/image-generation.md图片生成(image_generation_pro/image_generation)完整参数与响应
references/video-generation.md视频生成(fast_video/pro_video)完整参数与响应
references/script-generation.md视频脚本生成完整参数与响应
references/prompt-extraction.md图片/视频反推提示词完整参数与响应
references/polling-and-errors.md轮询机制、状态说明、错误处理

快速示例

默认专业模式生成图片

  1. 提交生成请求: {"type":"image_generation","prompt":"竹林深处,雾气缭绕","ratio":"9:16","fast":false,"resolution":"HD"}
  2. 等待生成完成(每隔 5 秒检查一次)
  3. 通知用户: 从 urls 获取完整图片链接,提示链接会过期

Comments

Loading comments...