Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
hf-sdxl-image
v1.1.1Generate an image from a text prompt through the Hugging Face Inference API using stabilityai/stable-diffusion-xl-base-1.0 and the HUGGINGFACE_TOKEN environm...
⭐ 0· 185·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (generate images via the Hugging Face Inference API) matches the included script and instructions. However, the registry metadata does not declare the HUGGINGFACE_TOKEN (required by the script) or the optional HF_IMAGE_MODEL environment variable. That omission is an inconsistency between claimed requirements and actual runtime needs.
Instruction Scope
SKILL.md stays on-topic: it explains converting prompts, running the provided script, saving a temporary file, and delivering the image via the active conversation provider. It does not instruct reading unrelated files or calling external endpoints beyond the Hugging Face router. It correctly instructs callers to handle provider-specific delivery and temporary-file deletion.
Install Mechanism
This is an instruction-only skill with a small included Python script. There is no install spec, no archive downloads, and no unusual install locations. The runtime uses Python stdlib modules only (urllib), which is proportionate to the task.
Credentials
The script requires HUGGINGFACE_TOKEN (mandatory) and reads HF_IMAGE_MODEL when present. The skill's registry metadata declares no required env vars or primary credential. Requiring an API token to call the HF inference endpoint is reasonable, but the metadata omission is a mismatch that can mislead users about what secrets the skill needs. The number of env vars is small and appropriate for the function, but they must be declared.
Persistence & Privilege
The skill does not request persistent installation, system-wide config access, or always: true. It writes only a temporary image file (or to a user-provided path) and relies on the caller to delete temp files after delivery, which is stated in SKILL.md.
What to consider before installing
This skill appears to be what it claims (it calls the Hugging Face router endpoint and saves the returned image locally), but the package metadata failed to declare required environment variables. Before installing, confirm you will provide a HUGGINGFACE_TOKEN (and optionally HF_IMAGE_MODEL) and that the token's permissions are scoped appropriately. Review the included script (it only POSTs to router.huggingface.co) and ensure you trust the runtime environment that will hold your token: if a compromised agent or skill were able to run autonomously, the token could be used to make API calls. Also verify how your OpenClaw instance sends images to the chat provider (SKILL.md requires provider-specific delivery and deletion of temporary files—this script prints the file path but does not perform deletion). If you proceed, prefer a scoped or temporary HF token and/or run the skill in an environment with limited privileges. Finally, ask the publisher to update the registry metadata to list HUGGINGFACE_TOKEN (primary credential) and HF_IMAGE_MODEL (optional) so requirements are explicit.Like a lobster shell, security has layers — review code before you run it.
latestvk97a1pbf72wfy0wxem7apbkeyh849ca5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.