volcengine-image-generate

Using volcengine image_generate.py script to generate image, need to provide clear and specific `prompt`.

Security Scan

The skill's code generally matches its purpose (generate images) but the SKILL.md, metadata, and packaging are inconsistent (missing declared env requirements, missing dependency/install instructions, and inaccurate output description), so it needs clarification before trusting or installing.

Purpose & Capability

The included script implements image generation using an Ark SDK and downloads generated images to disk, which aligns with the skill name and description. However, the skill metadata declares no required environment variables or dependencies even though the runtime requires an API key and an external Python SDK.

Instruction Scope

SKILL.md instructs callers to run the script and describes authentication behavior that doesn't fully match the code: the doc says the script "will return the generated image URL" and that it will fall back to VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY, but the script prints downloaded file paths (not the remote URL) and only reads MODEL_IMAGE_API_KEY or ARK_API_KEY. The documentation grants the agent authority to read environment variables that are not declared in the registry metadata.

Install Mechanism

There is no install spec; this is instruction-only, but the script imports volcenginesdkarkruntime (a Python package). The skill does not declare or provide instructions to install that dependency, so the runtime will fail unless the environment already has that package. Missing dependency/install instructions are a packaging/coherence issue.

Credentials

The script expects an API key via MODEL_IMAGE_API_KEY or ARK_API_KEY, which is appropriate for an image-generation client. However, the SKILL.md also claims it will use VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY as a fallback (the script does not reference these), and the registry metadata lists no required env vars. The skill therefore does not transparently declare the credentials it requires, which is a red flag for clarity and least-privilege review.

Persistence & Privilege

The skill is user-invocable, not always-enabled, and does not request persistent system privileges or modify other skills or system-wide settings. It only writes files to a download directory (default: current directory), which is expected behavior for an image-downloading script.

What to consider before installing

This skill appears to be what it says (generate images), but there are inconsistencies you should resolve before using it: - Authentication: The script requires an API key (MODEL_IMAGE_API_KEY or ARK_API_KEY) but the skill metadata lists no required env vars. Do not provide credentials unless you confirm which key the skill actually uses. The SKILL.md mentions VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY fallback, but the code does not use them—ask the author or inspect the Ark SDK behavior. - Dependency: The script imports volcenginesdkarkruntime. The skill provides no install instructions. Ensure that package is from a trusted source (pip package name and origin) and install it in a sandbox before running. - Output and file writes: The documentation states the script returns a generated image URL, but the script downloads images and prints local file paths. It writes to IMAGE_DOWNLOAD_DIR (default: current directory). Run it in a safe directory and verify filenames/permissions to avoid accidental overwrites. - Next steps: Ask the maintainer to (a) declare required env vars in the registry metadata, (b) provide install steps for the SDK or vendor the runtime dependency, and (c) fix SKILL.md to accurately describe output and fallback authentication behavior. If you must run it now, inspect the Ark SDK package source (or vendor), set the API key in a throwaway/test account, and run in an isolated environment.

Image Generate

Scenarios

When you need to generate an image based on a text description, use this skill to call the image_generate function.

Steps

1. Prepare a clear and specific prompt.
2. Run the script python scripts/image_generate.py "<prompt>". Before running, navigate to the corresponding directory.
3. The script will return the generated image URL.

Authentication and Credentials

• First, it will try to read the MODEL_IMAGE_API_KEY or ARK_API_KEY environment variables.
• If not configured, it will try to use VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY to get the Ark API Key.

Output Format

• The console will output the generated image URL.
• If the call fails, it will print the error information.

Examples

python scripts/image_generate.py "a cute cat"