Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Jimeng AI Image Generator

v1.0.2

即梦AI生图与视频生成工具。通过火山引擎API调用即梦AI,支持文生图、图片生成、视频生成。内置50+提示词模板覆盖电商、社交、商业设计、视频等场景。

0· 55·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for luis1213899/xingxiaolu-jimeng.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Jimeng AI Image Generator" (luis1213899/xingxiaolu-jimeng) from ClawHub.
Skill page: https://clawhub.ai/luis1213899/xingxiaolu-jimeng
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install xingxiaolu-jimeng

ClawHub CLI

Package manager switcher

npx clawhub@latest install xingxiaolu-jimeng
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description and the included Python scripts line up: they call Volcengine's visual.volcengineapi.com to submit image/video generation tasks. Requiring python is expected. However, the skill uses an on-disk secrets entry named 'jimeng' (AccessKeyId + SecretAccessKey) in ~/.openclaw/workspace/secrets.json; the registry metadata declares no required credentials or config paths. This is an incoherence: a networked cloud API key is required but not declared.
!
Instruction Scope
SKILL.md explicitly instructs the agent to use the token-manager 'jimeng' key and to run the included scripts. The scripts read ~/.openclaw/workspace/secrets.json, sign requests, call Volcengine, poll for results, and save image/video outputs to local files (temp_output.png, output.png). Those operations are within the stated purpose, but they access local secrets that were not declared and write files under the skill/agent workspace — the instructions therefore require access to sensitive local data without that being surfaced in the skill metadata.
Install Mechanism
No install spec — instruction- and script-based. That minimizes supply-chain install risk (no external downloads or package installs). The skill uses only Python stdlib urllib/hmac/hashlib; nothing fetched at install time.
!
Credentials
The code requires AccessKeyId and SecretAccessKey for Volcengine stored in a local secrets.json, but the skill metadata declares no required env vars or config paths. Requesting cloud API credentials for this purpose is reasonable, but failing to declare them is a transparency/permission problem. The credentials are sensitive (can be used to call Volcengine) and the skill will read them from disk automatically when invoked.
Persistence & Privilege
The skill is not always:true and does not attempt to modify other skills or global settings. It writes output files to the agent workspace and skill-relative paths (temp_output.png, output.png) which is expected behaviour for a generator; no persistent installation or background services are created.
What to consider before installing
This skill otherwise behaves like a normal Volcengine/Jimeng client, but it will automatically read credentials from ~/.openclaw/workspace/secrets.json under the key name 'jimeng' (AccessKeyId + SecretAccessKey) even though the registry doesn't declare any required credentials. Before installing or running it, verify: (1) the 'jimeng' entry in your token-manager/secrets.json is intended for this tool and has minimal permissions; (2) you trust the skill source (owner/homepage not provided); (3) inspect the secrets.json file and the scripts yourself if possible. If you don't want the skill to access your saved keys, do not install/run it or move/remove the 'jimeng' entry. Also note the skill will write image/video files to the agent workspace (temp_output.png, output.png).

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
Binspython
aivk97bvdt44hb1ezf10s6n6v88wh85jdraimagevk97bvdt44hb1ezf10s6n6v88wh85jdralatestvk97bvdt44hb1ezf10s6n6v88wh85jdratext-to-imagevk97bvdt44hb1ezf10s6n6v88wh85jdravideovk97bvdt44hb1ezf10s6n6v88wh85jdra
55downloads
0stars
2versions
Updated 1d ago
v1.0.2
MIT-0

即梦AI (Jimeng AI)

通过火山引擎 API 调用即梦AI,支持文生图图生视频

凭证

使用 token-manager 中保存的 jimeng 密钥:

  • key: jimeng
  • 内容: AccessKeyId + SecretAccessKey

快速使用

文生图(推荐)

# 生图并保存到文件
python skills/jimeng-ai/scripts/generate.py --prompt "描述" --output image.png

# 生图输出 MEDIA_URL(用于 OpenClaw 内联显示)
python skills/jimeng-ai/scripts/generate.py --prompt "描述"

查询任务

python skills/jimeng-ai/scripts/query.py <task_id> [req_key]

视频生成

python skills/jimeng-ai/scripts/video.py "描述" --duration 5

提示词模板库

内置50+即梦提示词模板,详见:

📋 references/prompts-templates.md

分类模板数场景
🛒 电商促销海报15个双11/618/春节/520/3C数码/美妆/运动等
📱 社交媒体图文10个小红书/朋友圈/知识科普/美食/健身/职场
🎨 商业设计8个Logo/IP形象/UI图标/VI系统
🎬 视频生成10个Vlog/品牌广告/国潮/创意短片

万能公式

主体 + 动作/状态 + 场景环境 + 风格美学 + 光影氛围 + 镜头视角 + 画质参数

示例:

  • ❌ "一只猫在沙发上。"
  • ✅ "一只橘色的胖猫慵懒地躺在棕色的真皮沙发上,午后阳光从落地窗斜射进来,空气中有细小的灰尘颗粒在舞动,电影质感,浅景深,8K超高清。"

参数说明

文生图 (req_key: jimeng_t2i_v40)

参数说明
--prompt, -p图像描述(必填)
--aspect宽高比: 1:1(默认), 3:4, 4:3, 16:9, 9:16
--seed随机种子,-1 表示随机
--output, -o保存路径(不填则输出 MEDIA_URL)

文生视频 (req_key: jimeng_i2v_first_v30_1080)

参数说明
--prompt视频描述(必填)
--duration时长(秒): 5-10(默认5)
--seed随机种子

输出格式

Task submitted: <task_id>
IMAGE_SAVED: /path/to/image.png    # --output 模式
MEDIA_URL: https://...             # 无 --output 模式

进阶技巧

  1. 角色定位 — 提示词开头加"你是一位资深电商平面设计师"
  2. 锁定元素 — 引号标出必出内容,如"标题为'盛夏狂欢节'"
  3. 风格先行 — 越早写"风格"效果越好
  4. 分阶段生成 — 先简短提示词验证构图,满意后再加细节
  5. 参考图 — 支持参考图+提示词双保险

注意事项

  1. 生图任务通常 5-10 秒完成,视频任务 30-60 秒
  2. 免费账户每日有积分限制(约66次生图)
  3. 轮询间隔建议 3-5 秒,避免频繁请求
  4. 图片通过 binary_data_base64 返回,无需处理过期URL

Comments

Loading comments...