Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Infographic Image

v0.1.0

将任意主题、长文、报告、纪要或说明文本稳定转换成中文视觉生图提示词, 然后调用 DashScope Qwen 图像模型直接出图。适用于“把这段内容做成信息图”、 “做成故事漫画长图”、“长文转图”、“生成中文生图 prompt”、“根据文档出图” 等场景;默认采用白色磁吸会议板手写风格,也支持切换到其他内置模板。

0· 362·3 current·3 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yeyitech/infographic-image.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Infographic Image" (yeyitech/infographic-image) from ClawHub.
Skill page: https://clawhub.ai/yeyitech/infographic-image
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install yeyitech/infographic-image

ClawHub CLI

Package manager switcher

npx clawhub@latest install infographic-image
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose is to produce Chinese infographic prompts and call DashScope's Qwen image model; the included script directly calls DashScope endpoints (dashscope.aliyuncs.com) which is coherent with the description. However, the registry metadata claims 'Required env vars: none' while the SKILL.md and scripts require a DASHSCOPE_API_KEY — a clear metadata omission that hides a sensitive requirement.
!
Instruction Scope
Runtime instructions and the script accept --text-file / --style-file and will read arbitrary local files specified by absolute paths and then send the content to DashScope text/image endpoints for inference. That behavior is expected for this tool's purpose, but it means any file path the agent or user provides can be uploaded to an external service; the SKILL.md suggests using --text-file (even recommending it). There is no unexpected access to other system paths, but the power to read and transmit arbitrary local files is a notable scope risk.
Install Mechanism
No install spec — instruction-only plus an included Python script. Nothing is downloaded at install time; no archive URLs or third-party installers are used. This is the lower-risk install model.
!
Credentials
The runtime expects a DASHSCOPE_API_KEY (SKILL.md shows export DASHSCOPE_API_KEY) but the package metadata lists no required environment variables or primary credential. Requiring a single API key for the third-party DashScope service is proportionate to the stated functionality, but the metadata omission is misleading. The skill will transmit user content to the external API keyed by that secret, so the secret grants remote service access and should be declared and scoped explicitly.
Persistence & Privilege
The skill does not request 'always: true' or write to other skills' configurations. It runs as an on-demand script and does not appear to persist elevated privileges or modify system-wide agent settings.
What to consider before installing
Key things to consider before installing and using this skill: - The script will send whatever text you provide (including the contents of any file path you pass) to DashScope's APIs. Do not pass sensitive files (passwords, private keys, internal documents) unless you're certain you want them uploaded to that third-party service. - The package metadata does not declare the required DASHSCOPE_API_KEY, but the SKILL.md and script require it. Treat this as a red flag in bookkeeping: the credential is necessary and sensitive. - Verify you trust the DashScope endpoint (dashscope.aliyuncs.com) and the account tied to the API key. Use a limited-scope/test API key when possible. - If you plan to run this inside an autonomous agent, be aware the agent could choose arbitrary file paths to feed into the script; restrict agent permissions or disable implicit invocation if that is a concern. - Recommended actions: (1) Review the full script locally to confirm behavior. (2) Only provide non-sensitive input or use --dry-run to inspect generated prompts before rendering. (3) Ask the publisher to update registry metadata to declare DASHSCOPE_API_KEY as a required credential and to document any additional telemetry or logs the script produces.

Like a lobster shell, security has layers — review code before you run it.

chinesevk97fstrqav9je5jq1jtbwa3q5n82gsapdesignvk97fstrqav9je5jq1jtbwa3q5n82gsapimagevk97fstrqav9je5jq1jtbwa3q5n82gsapinfographicvk97fstrqav9je5jq1jtbwa3q5n82gsaplatestvk97fstrqav9je5jq1jtbwa3q5n82gsapvisualizationvk97fstrqav9je5jq1jtbwa3q5n82gsap
362downloads
0stars
1versions
Updated 19h ago
v0.1.0
MIT-0

Infographic Image

Overview

使用 scripts/generate_infographic.py 将任意输入内容压缩为稳定的中文视觉生图提示词,再调用 DashScope 默认模型 qwen-image-2.0-pro 出图并下载到本地。

Quick Start

  1. 配置 API Key:
export DASHSCOPE_API_KEY="<your_api_key>"
  1. 从长文直接生成图像:
python3 scripts/generate_infographic.py \
  --text-file /absolute/path/article.md \
  --size "1440*1800"
  1. 只生成稳定 prompt,不出图:
python3 scripts/generate_infographic.py \
  --text "这里放任意中文或英文内容" \
  --dry-run
  1. 加载自定义风格补充:
python3 scripts/generate_infographic.py \
  --text-file /absolute/path/report.txt \
  --style-preset comic-story \
  --style-file /absolute/path/custom-style.md

Workflow

  1. --topic--text--text-file 收集原始素材。
  2. 从内置模板中选择一套协议与风格;若未指定,则默认使用白色磁吸会议板手写风格。
  3. 可选叠加 references/styles/*.md 或外部风格文件作为补充。
  4. 调用 DashScope 文本模型生成严格 JSON,提取 image_generation_prompt
  5. 使用默认模型 qwen-image-2.0-pro 渲染图像并保存到本地。
  6. 若推理失败,使用脚本内置兜底模板生成可用 prompt。

Key Files

  • references/meta-prompt.md:信息图模板的元提示词。
  • references/meta-prompts-comic-story.md:新中式漫画故事模板的元提示词。
  • references/styles/default.md:信息图手绘笔记风格。
  • references/styles/clean-editorial.md:信息图编辑排版风格。
  • references/styles/comic-story.md:新中式漫画故事风格。
  • references/meta-prompts-spatial-gallery.md:空间化画廊信息图模板的元提示词。
  • references/styles/spatial-gallery.md:洁净实验室 / 画廊装置信息图风格。
  • references/meta-prompts-frosted-whiteboard.md:白色磁吸会议板手写图模板的元提示词。
  • references/styles/frosted-whiteboard.md:白色磁吸会议板 + 手写板书风格。
  • scripts/generate_infographic.py:统一入口脚本。

Extend Styles

内置模板当前包含 defaultclean-editorialcomic-storyspatial-galleryfrosted-whiteboard。其中 default 默认就是白色磁吸会议板手写风格;如需随机,可显式传 --style-preset random。新增模板时,优先补齐对应协议与风格文件;如果只是临时试验,也可以直接传 --style-file--style-hint

High-Value Options

  • --topic:简短主题。
  • --text:直接传长文本。
  • --text-file:从本地文件读取正文。
  • --style-preset:选择内置模板,如 defaultclean-editorialcomic-storyspatial-galleryfrosted-whiteboard;留空走默认,传 random 才随机。
  • --style-file:加载外部风格文件。
  • --style-hint:临时补充风格偏好。
  • --dry-run:只输出推理出的 prompt 和负面提示词,不调用生图。
  • --prompt-output:将推理结果 JSON 保存到本地。
  • --size:输出尺寸,如 1440*18001664*9281328*1328
  • --prompt-model:提示词推理模型,默认 qwen-plus
  • --image-model:可选覆盖生图模型;默认 qwen-image-2.0-pro,通常无需修改。

Reliability Rules

  1. 长文本优先通过 --text-file 输入,避免 shell 转义污染。
  2. 模板级规则放在 references/meta-prompt*.md,不要把长规则堆回 SKILL.md
  3. 风格扩展放进 references/styles/,保持工作流稳定、风格可替换。
  4. 生成失败时先用 --dry-run 检查推理出的 prompt,再决定是否改风格补充。
  5. 默认按 qwen-image-2.0-pro 使用自由宽高尺寸,建议直接传目标成图尺寸,如 1440*18001600*1200

Comments

Loading comments...