ClawHub

AI Christmas Photo Generator - Create Festive Images Online – API-powered

v1.0.0

AI Christmas photo generator — transform a portrait into a festive Christmas scene

⭐ 0· 8·0 current·0 all-time
by@sparkleming
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, declared endpoint hosts (openapi.weshop.ai), and the single required env var (WESHOP_API_KEY) are coherent for an AI image-generation skill that uploads a portrait and starts runs.
✓
Instruction Scope
SKILL.md restricts network calls to openapi.weshop.ai, instructs to check WESHOP_API_KEY before asking the user, and documents only the agent-run and image-upload endpoints. It does mention uploading a local image (expected for this skill); it does not instruct reading unrelated files or exfiltrating other environment data.
✓
Install Mechanism
Instruction-only skill with no install steps or code files; nothing is written to disk or downloaded during install, which is the lowest-risk model.
✓
Credentials
Only a single API key (WESHOP_API_KEY) is required and is appropriate for calling the documented WeShop endpoints. The skill explicitly warns to only send the key to openapi.weshop.ai and to avoid other domains.
✓
Persistence & Privilege
No always:true flag, no install-time persistence, and no requests to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill appears to do what it says: it will call WeShop's OpenAPI and requires your WESHOP_API_KEY. Before installing, ensure you trust the provider of the skill (source is unknown). Only provide an API key if you are comfortable sending images to WeShop; consider creating a scoped or revocable key if the service supports it. The SKILL.md warns to only send the key to openapi.weshop.ai — verify the platform actually enforces that the key is used only for calls to that domain. Remember any images you upload will be transmitted to the external service (privacy risk). If you later stop using the skill, revoke or rotate the API key.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ccqcaaxjcgfmcv7400gsy1584n9zr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvWESHOP_API_KEY
Primary envWESHOP_API_KEY

Comments