Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Jiekou Multimodal

v0.2.0

使用接口AI 执行多模态任务:文生图、图生图、文生视频、图生视频、TTS、STT。 适用于:生成图片、生成视频、文字转语音、语音识别。

1· 329·2 current·2 all-time
bybbear@ximasadila
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (multimodal generation: image/video/TTS/STT) aligns with the endpoints and models described in SKILL.md and references. The API endpoints (api.jiekou.ai) and models listed are coherent with the stated purpose.
!
Instruction Scope
The runtime instructions require reading an API key from three sources (user messages, ~/.jiekou/config.json, JIEKOU_API_KEY). The skill explicitly instructs searching user messages for 'sk_' keys and accepting API keys pasted by users — this encourages users to paste secrets into chat and grants the skill permission to parse messages for secrets. The SKILL.md also references calling /openai/v1/chat/completions in places (for image understanding) without clarifying whether that is proxied by jiekou.ai or requires an additional OpenAI key. Also the registry metadata declares no required config path/env var, but instructions clearly depend on filesystem and env access (mismatch).
Install Mechanism
Instruction-only skill with no install spec or downloads. No code executed from external URLs and no package installs — low install risk.
!
Credentials
The skill needs an API key for the external service which is proportionate to the function, but the manifest does not declare any required env vars or config paths while the instructions require JIEKOU_API_KEY or ~/.jiekou/config.json. Additionally, the practice of extracting 'sk_' keys from user messages is risky: it may capture unrelated secrets the user types. There is also ambiguity about calls to /openai/v1 endpoints (potentially needing separate credentials) that the skill does not declare.
Persistence & Privilege
always:false and no install actions. The skill recommends creating ~/.jiekou/config.json (user-run command) — this writes to the user's home if they follow instructions, which is expected for storing an API key but is not declared in the registry metadata.
What to consider before installing
This skill appears to be a client for a multimodal API (images/video/TTS/STT) and needs an API key to work, but the package metadata doesn't declare that need and the instructions instruct the agent to search user messages for keys (looks for 'sk_' strings) and to read/write ~/.jiekou/config.json or JIEKOU_API_KEY. Before installing: (1) Do not paste other services' API keys into chat — prefer setting the key in the local config file or a dedicated environment variable for jiekou.ai; (2) Verify you trust the domain https://api.jiekou.ai and the guidance URL https://jiekou.ai; (3) Confirm whether the skill's calls to /openai/v1 are proxied by jiekou.ai or require additional credentials; (4) If you want minimal risk, avoid the 'paste key in chat' option and only use an API key with least-privilege billing/usage; (5) The mismatch between declared requirements and instructions is a red flag — ask the author to declare required env vars/config paths and to remove automatic scanning of user messages for 'sk_' keys.

Like a lobster shell, security has layers — review code before you run it.

latestvk97568tzj1jb442gepvgbyfw7982s7wn
329downloads
1stars
2versions
Updated 8h ago
v0.2.0
MIT-0

接口AI 多模态执行

配置方式(三选一,按优先级)

方式1:配置文件(推荐)

创建文件 ~/.jiekou/config.json

{
  "api_key": "你的API_Key"
}

一条命令完成配置:

mkdir -p ~/.jiekou && echo '{"api_key": "你的API_Key"}' > ~/.jiekou/config.json

方式2:环境变量

export JIEKOU_API_KEY="你的API_Key"

方式3:直接传参

在请求中直接提供:请用 API Key sk_xxx 生成一张图片...


API Key 读取逻辑

1. 检查用户消息中是否包含 API Key(sk_ 开头)
2. 检查配置文件 ~/.jiekou/config.json
3. 检查环境变量 JIEKOU_API_KEY
4. 都没有 → 返回配置引导

配置引导消息(仅在未配置时显示):

您还没有配置接口AI的 API Key。

快速配置(复制运行):
mkdir -p ~/.jiekou && echo '{"api_key": "你的Key"}' > ~/.jiekou/config.json

获取 Key:https://jiekou.ai/settings/key-management

执行流程(重要!)

用户请求 → 识别任务 → 获取 Key → ⚠️ 先发提示 → 执行任务 → 返回结果

⚠️ 必须先发送进度提示

在调用 API 之前,必须先回复用户一条消息:

🎨 收到!正在为您生成图片...

任务类型:文生图
使用模型:Gemini 3.1 Flash Image
预计耗时:10-30秒
预计费用:约 $0.03 元

请稍等,生成完成后会立即发送给您 ⏳

这条消息必须在执行 API 调用之前发送! 这样用户就知道任务已经开始处理,不会以为系统卡住了。

不同任务的提示模板

文生图:

🎨 收到!正在为您生成图片...
使用模型:Gemini 3.1 Flash Image
预计耗时:10-30秒

文生视频:

🎬 收到!正在为您生成视频...
使用模型:Veo 3.1
预计耗时:1-3分钟(视频生成较慢,请耐心等待)

TTS:

🔊 收到!正在为您生成语音...
使用模型:MiniMax Speech 2.6
预计耗时:5-10秒

完成后的回复

✅ 生成完成!

[图片/视频/音频 URL]

实际消耗:$0.03 元

视频任务的轮询提示

视频生成需要轮询,每 15 秒更新一次状态:

🎬 视频生成中...
当前状态:处理中
已等待:30 秒
预计还需:1-2 分钟

API 配置

配置项
Base URLhttps://api.jiekou.ai
鉴权Authorization: Bearer <API_KEY>
获取 Keyhttps://jiekou.ai/settings/key-management

任务类型与端点

任务端点默认模型快速模型
文生图/v3/gemini-3.1-flash-image-text-to-imageGemini 3.1 FlashSeedream 5.0 Lite
图片编辑/v3/gemini-3.1-flash-image-editGemini 3.1 Flash-
文生视频/v3/async/veo-3.1-generate-text2videoVeo 3.1Hailuo 2.3
图生视频/v3/async/veo-3.1-generate-img2videoVeo 3.1Hailuo 2.3
TTS/v3/minimax-speech-2.6-turboMiniMax Speech 2.6-
任务查询/v3/async/task-result?task_id=xxx--

快速模型触发词: 用户说"快点"、"加速"、"着急"时使用快速模型


执行模板

文生图

curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-text-to-image" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "size": "1K", "aspect_ratio": "1:1"}'

快速模式:

curl -X POST "https://api.jiekou.ai/v3/seedream-5.0-lite" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述"}'

图片编辑

curl -X POST "https://api.jiekou.ai/v3/gemini-3.1-flash-image-edit" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "编辑指令", "reference_images": ["图片URL"]}'

文生视频

curl -X POST "https://api.jiekou.ai/v3/async/veo-3.1-generate-text2video" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "duration_seconds": 4}'

快速模式:

curl -X POST "https://api.jiekou.ai/v3/async/minimax-hailuo-2.3-t2v" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "描述", "duration": 6}'

图生视频

curl -X POST "https://api.jiekou.ai/v3/async/veo-3.1-generate-img2video" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "动作描述", "image": "图片URL"}'

TTS

curl -X POST "https://api.jiekou.ai/v3/minimax-speech-2.6-turbo" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "要转换的文字",
    "voice_setting": {"voice_id": "male-qn-qingse", "speed": 1.0},
    "audio_setting": {"format": "mp3"}
  }'

可用声音:

  • 男声:male-qn-qingse(青涩)、male-qn-jingying(精英)
  • 女声:female-shaonv(少女)、female-yujie(御姐)

任务结果查询

curl "https://api.jiekou.ai/v3/async/task-result?task_id=$TASK_ID" \
  -H "Authorization: Bearer $API_KEY"

状态: TASK_STATUS_QUEUEDTASK_STATUS_PROCESSINGTASK_STATUS_SUCCEED


错误处理

错误码含义处理
401Key 无效检查配置
402余额不足https://jiekou.ai/billing 充值
429请求过快等待重试

定价

https://jiekou.ai/pricing

Comments

Loading comments...