AI Hair Color Changer – Try Hair Colors Online Free with Virtual Try-On – CLI-powered
v1.0.0AI hair color changer — change a person's hair color while preserving hairstyle and details
⭐ 0· 44·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill claims to call the weshop CLI and requires a WESHOP_API_KEY, which is appropriate for an image-transform service. However, registry metadata earlier listed no required binaries while the SKILL.md explicitly states the 'weshop' command is required—this mismatch is likely an oversight but should be fixed for clarity.
Instruction Scope
SKILL.md limits runtime actions to checking WESHOP_API_KEY, prompting the user if not set, and invoking the weshop CLI with image and prompt options. It does not instruct reading unrelated files or env vars or exfiltrating data to unexpected endpoints; the only external endpoint referenced is openapi.weshop.ai (per the doc).
Install Mechanism
The skill is instruction-only (no install spec). It recommends installing the weshop-cli via 'npm install -g weshop-cli' and links to the npm/GitHub pages. This is a typical recommendation but installing third-party global npm packages carries the normal risk of executing unreviewed code — the skill itself does not perform any downloads.
Credentials
Only WESHOP_API_KEY is required and declared as primaryEnv, which is proportionate to a CLI that calls a cloud image-transform API. SKILL.md warns against passing the key on the command line and instructs to read it from the environment, which is appropriate.
Persistence & Privilege
The skill does not request permanent presence (always:false) and does not ask to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with other concerning attributes.
Scan Findings in Context
[no_code_to_scan] expected: The package is instruction-only (SKILL.md) and contains no code files for the regex scanner to analyze. This is expected for a CLI-invocation skill.
Assessment
This skill looks coherent with its stated purpose, but before installing/use: 1) confirm the 'weshop-cli' npm package and its GitHub repo are legitimate and review the package code or maintainers if possible; 2) only obtain an API key from the official WeShop authorization page linked in SKILL.md and never paste the API key into chat or as a CLI argument; 3) be aware that images you upload will be sent to the remote service (privacy considerations); and 4) note the small metadata mismatch (the skill expects the 'weshop' command but the registry metadata omitted required binaries) — it’s likely harmless but you may want the publisher to correct it for clarity.Like a lobster shell, security has layers — review code before you run it.
latestvk97ccjzz8hdxkkpbjjm1gg7yv184r3v7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvWESHOP_API_KEY
Primary envWESHOP_API_KEY