LiblibAI Image & Video Gen
v1.0.0Generate images with Seedream4.5 and videos with Kling via LiblibAI API. Use when user asks to generate/create images, pictures, illustrations, or videos using LiblibAI, Seedream, or Kling models.
⭐ 0· 3.8k·2 current·2 all-time
by远方青木@xtaq
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and bundled Python client clearly implement LiblibAI image (Seedream4.5) and video (Kling) generation and require API credentials — that aligns with the stated purpose. However, the registry metadata declares no required environment variables or primary credential while the runtime instructions and code require LIB_ACCESS_KEY and LIB_SECRET_KEY. The omission in metadata is an incoherence that reduces transparency.
Instruction Scope
SKILL.md instructs the agent to run the included Python CLI which authenticates and posts generation requests to https://openapi.liblibai.cloud and polls job status. The instructions and code only reference the declared API endpoints, prompt parameters, and the two API env vars; they do not attempt to read unrelated files, other env vars, or send data to unexpected endpoints.
Install Mechanism
There is no install specification (instruction-only with a bundled script). That is low-risk compared with arbitrary downloads. The package includes a single Python script relying on requests; no external installers or obscure URLs are used.
Credentials
The code legitimately needs an API access key and secret (LIB_ACCESS_KEY and LIB_SECRET_KEY) to call the service — that is proportionate to the function. However, the skill registry metadata lists no required env vars; this discrepancy could trick automated gates or users into installing without realizing they must supply secrets. The only sensitive data the skill uses is the two API credentials (no other secrets appear in code).
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system config, and runs only when invoked. It does not request elevated persistence or system-wide privileges.
What to consider before installing
Before installing, verify the skill's origin (no homepage/source provided) and confirm you trust LiblibAI and the owner. The skill requires two sensitive env vars (LIB_ACCESS_KEY and LIB_SECRET_KEY) that will be sent to https://openapi.liblibai.cloud — only provide keys you control and are comfortable using with a third-party skill. Ask the publisher to update registry metadata to declare the required env vars (transparency improves security). If you cannot verify the source, prefer an officially published client or use short-lived credentials and monitor their use. If you install, inspect or run the included script in a sandbox first (it uses HMAC-SHA1 signing and posts job requests and polling calls; there is no other hidden exfiltration in the code).Like a lobster shell, security has layers — review code before you run it.
latestvk97d56f582z1sake72tah98j9h80rq9a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.