ClawHub

Yollomi AI Image & Video Generator

v1.1.0

AI image generator skill (image, image generation). Multi-model image generator for Yollomi to generate AI images via one unified API endpoint. Requires YOLL...

⭐ 6· 2.4k·1 current·1 all-time
by@anichikage
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name, description, SKILL.md examples, and code (index.ts) all implement calls to a unified Yollomi API endpoint and only require YOLLOMI_API_KEY (plus an optional YOLLOMI_BASE_URL). Nothing in the manifest or files asks for unrelated services or credentials.
✓
Instruction Scope
Runtime instructions and curl examples only call the Yollomi endpoints and reference YOLLOMI_API_KEY and optional YOLLOMI_BASE_URL. The SKILL.md does not instruct reading unrelated files, secret stores, or transmitting data to unexpected endpoints.
ℹ
Install Mechanism
There is no install spec (lowest-risk), but the package includes TypeScript source (index.ts) and a shell test script. No remote downloads or extract steps are present. Note: runtime environment must support executing the provided code (TypeScript) — build/run details are not included but this is an operational, not a security, concern.
✓
Credentials
Only YOLLOMI_API_KEY is required (and optional YOLLOMI_BASE_URL). No other SECRET/TOKEN/PASSWORD env vars are requested. The requested credential is proportional to an API client for image/video generation.
✓
Persistence & Privilege
The skill is not always-enabled, is user-invocable, and does not request elevated or persistent platform privileges or modification of other skills. Autonomous invocation is allowed (platform default) and is not combined with other red flags.
Assessment
This skill appears coherent: it only needs a YOLLOMI_API_KEY and calls the yollomi.com API. Before installing, confirm you trust the Yollomi service and that the API key you provide is scoped appropriately (use a key with limited permissions/credits if possible). Review your billing/credit implications for the listed models. Note there is no build/install script included — make sure your runtime can load/execute the provided TypeScript or that the platform handles that for you. If you do not recognize or trust yollomi.com, do not supply a production API key.
✗
index.ts:19
Environment variable access combined with network send.
Confirmed safe by external scanners
Static analysis detected API credential-access patterns, but both VirusTotal and OpenClaw confirmed this skill is safe. These patterns are common in legitimate API integration skills.

Like a lobster shell, security has layers — review code before you run it.

aivk97a5vna2st3p1tyxyyq76vzf9810qw1all-modelsvk97a5vna2st3p1tyxyyq76vzf9810qw1generatorvk97a5vna2st3p1tyxyyq76vzf9810qw1imagevk97a5vna2st3p1tyxyyq76vzf9810qw1image-generationvk97a5vna2st3p1tyxyyq76vzf9810qw1image-generatorvk97a5vna2st3p1tyxyyq76vzf9810qw1latestvk97anx0fe9ar25nnhbkny5sy0h836n3fmultimodelvk97a5vna2st3p1tyxyyq76vzf9810qw1yollomivk97a5vna2st3p1tyxyyq76vzf9810qw1

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvYOLLOMI_API_KEY

Comments