Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Beauty Image

v3.2.0

商业化AI图片生成助手。40+场景模板, 30+风格词典, 智能意图识别, 结构化Prompt, 三引擎智能路由 (Wanx/Seedream4/Seedream5)。

0· 128·2 current·2 all-time
by圆规@yh22e

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yh22e/beauty-image.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Beauty Image" (yh22e/beauty-image) from ClawHub.
Skill page: https://clawhub.ai/yh22e/beauty-image
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: DASHSCOPE_API_KEY, ARK_API_KEY, DEEPSEEK_API_KEY
Required binaries: uv
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install beauty-image

ClawHub CLI

Package manager switcher

npx clawhub@latest install beauty-image
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name/description match the code: scripts build prompts, parse intent, and call three image/LLM providers (DashScope/Wanx, VolcEngine/Seedream, DeepSeek). Requesting the 'uv' binary is coherent. However, the registry metadata (requires.env) lists DASHSCOPE_API_KEY, ARK_API_KEY, and DEEPSEEK_API_KEY as required, while README/SKILL.md and the scripts treat only at least one provider key as necessary (ARK and DEEPSEEK are optional). This is an inconsistency between declared requirements and actual need.
Instruction Scope
SKILL.md instructs the agent to ask user confirmation, run the provided scripts, parse MEDIA_URL lines, and not download images unless requested. Runtime instructions reference ~/.openclaw/openclaw.json and expected API endpoints (dashscope.aliyuncs.com, ark.cn-beijing.volces.com, api.deepseek.com) which are consistent with purpose. There are no instructions to read unrelated files or exfiltrate arbitrary data.
Install Mechanism
No external download/install spec is present (instruction + included Python scripts). Dependencies are normal (uv runner and requests). No suspicious remote installers, URL shorteners, or extracted archives are used.
!
Credentials
The skill metadata marks three API keys as required, but the code clearly treats ARK_API_KEY (Seedream) and DEEPSEEK_API_KEY (LLM intent parsing) as optional — only one provider key is needed for functionality. Declaring all three as required is disproportionate and misleading. The primaryEnv = DASHSCOPE_API_KEY is reasonable, but users should not supply unrelated keys unless needed. The scripts also read ~/.openclaw/openclaw.json for keys, which is proportional to the stated purpose but is additional config access to note.
Persistence & Privilege
always:false and disable-model-invocation:false (normal). The skill does not request permanent system-wide privileges and does not modify other skills' configs. It only reads its own config and optionally ~/.openclaw/openclaw.json.
What to consider before installing
This skill appears to do what it says (build prompts, detect intent, and call three image/LLM providers). Before installing: (1) Note the metadata incorrectly lists ARK_API_KEY and DEEPSEEK_API_KEY as required — you only need to provide at least one provider key (DASHSCOPE_API_KEY or ARK_API_KEY) and DEEPSEEK is optional for deeper LLM parsing. Do not put unrelated secrets into environment variables or openclaw.json. (2) Expect the skill to make network calls to DashScope (Aliyun), VolcEngine (Seedream), and DeepSeek; those services will receive your prompts and may incur usage costs — only enable the keys you trust. (3) Run scripts/check.py after installation to verify configured keys and behavior. (4) If you want to limit exposure, only set the single API key for the provider you plan to use (e.g., DASHSCOPE_API_KEY) and do not provide ARK/DEEPSEEK unless you need them. (5) If you need higher assurance, review the network calls in the generate_*.py files and test in an isolated environment.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
OSmacOS · Linux · Windows
Binsuv
EnvDASHSCOPE_API_KEY, ARK_API_KEY, DEEPSEEK_API_KEY
Primary envDASHSCOPE_API_KEY
latestvk971w0c0mx4432sanqmc11km1183aj0t
128downloads
0stars
2versions
Updated 1mo ago
v3.2.0
MIT-0
macOS, Linux, Windows

Beauty Image V3 — 商业化AI图片生成

AI 图片生成助手。触发后必须先询问用户确认,再执行生成。

V3升级: 意图识别(40+场景) + 结构化Prompt + 风格词典(30+) + 智能引擎路由

触发场景询问确认内容
名片设计姓名、职称、公司、风格(赛博朋克/极简/金属)
海报创作主题、配色、排版风格、文字元素
头像/IP人物描述、风格、表情、背景
产品摄影产品描述、背景、布光偏好
3D/材质主体、材质(水晶/毛绒/充气/乐高)、场景
通用图片画面描述、尺寸比例、风格、引擎选择

执行流程: 触发 → 意图识别 → 模板匹配 → 询问缺失信息 → Prompt构建 → 引擎路由 → 生成 → 展示

Usage (V3 脚本, 推荐)

智能模式 (自动识别意图+模板+路由)

uv run {baseDir}/scripts/generate_image_v3.py --prompt "帮我做一张赛博朋克风格的个人名片"
uv run {baseDir}/scripts/generate_image_v3.py --prompt "画一只猫的水晶质感手办"
uv run {baseDir}/scripts/generate_image_v3.py --prompt "上海天气卡片"
uv run {baseDir}/scripts/generate_image_v3.py --prompt "做个毛绒版的苹果logo"

指定场景模板

uv run {baseDir}/scripts/generate_image_v3.py --prompt "猫" --scene 3d_crystal
uv run {baseDir}/scripts/generate_image_v3.py --prompt "武士" --scene art_ukiyoe_card --style 浮世绘
uv run {baseDir}/scripts/generate_image_v3.py --prompt "咖啡店" --scene 3d_miniature

指定字段 (JSON)

uv run {baseDir}/scripts/generate_image_v3.py --prompt "名片" --scene biz_card --fields '{"name":"圆规","title":"CEO","company":"XyvaClaw"}'

Raw模式 (兼容V2, 直接传prompt)

uv run {baseDir}/scripts/generate_image_v3.py --prompt "一幅美丽的风景画" --raw

指定尺寸/比例

uv run {baseDir}/scripts/generate_image_v3.py --prompt "城市全景" --size 全景
uv run {baseDir}/scripts/generate_image_v3.py --prompt "手机壁纸" --size 9:16
uv run {baseDir}/scripts/generate_image_v3.py --prompt "小红书配图" --size 小红书
uv run {baseDir}/scripts/generate_image_v3.py --prompt "电影海报" --size 海报

列出模板/风格/引擎/尺寸

uv run {baseDir}/scripts/generate_image_v3.py --list-scenes
uv run {baseDir}/scripts/generate_image_v3.py --list-styles
uv run {baseDir}/scripts/generate_image_v3.py --list-providers
uv run {baseDir}/scripts/generate_image_v3.py --list-sizes

尺寸和比例 (15种 + 中文别名)

支持 15 种宽高比,可用比例名、中文别名或直接像素值指定。

比例wanx 尺寸中文别名
1:11280×1280正方, 头像
3:41104×1472小红书, A4
4:31472×1104
9:16960×1696竖版, 手机壁纸
16:91696×960横版, PPT, 名片
2:31048×1568海报
3:21568×1048
1:2904×1816
2:11808×912
9:21840×1960竖屏, 长图
21:91952×840宽屏, 电影
1:3744×2224长海报
3:12216×744横幅, banner
1:4640×2560超长, 滚动长图
4:12560×640全景, 超宽

Seedream 引擎支持 2K/3K 高分辨率输出。

场景模板 (26+)

分类模板ID名称推荐引擎
商务biz_card名片设计seedream5
商务biz_poster商业海报seedream5
商务biz_product产品摄影seedream4
社交social_avatar头像/IPseedream4
社交social_emoji表情包wanx
社交social_card金句卡片wanx
创意art_general艺术创作seedream5
创意art_ukiyoe_card浮世绘闪卡seedream5
3D3d_crystal水晶质感seedream5
3D3d_plush毛绒玩具seedream4
3D3d_inflatable充气玩具seedream4
3D3d_miniature微缩房间seedream5
实用util_weather天气卡片seedream5
实用util_fridge_magnet冰箱贴seedream5
实用util_food_map美食地图seedream5
实用util_storyboard电影分镜seedream5
设计design_pptPPT页面seedream5
设计design_logoLogowanx
设计design_packaging包装设计seedream5
人物person_portrait写实肖像seedream5
人物person_action_figure手办seedream5
场景scene_chalkboard黑板粉笔画seedream4
电商ecom_main电商主图wanx
电商ecom_banner电商横幅wanx
内容content_xhs小红书配图seedream4
内容content_blog文章头图wanx

风格词典 (20+)

赛博朋克, 浮世绘, 水墨画, 吉卜力, 像素风, 油画, 漫画, 波普艺术, 清明上河图, 水晶, 毛绒, 充气, 乐高, 黏土, 电影感, 产品摄影, 街拍, 胶片, 等距微缩, 3D渲染

引擎选择指南

引擎适用场景画质速度费用
seedream5最高画质,组图⭐⭐⭐⭐⭐
seedream4高画质,性价比⭐⭐⭐⭐较快
wanx文字渲染好⭐⭐⭐

V3自动按场景+风格路由引擎, 无需手动选择。

API Key 配置 (首次使用必读)

本技能需要至少配置 一个 API Key 才能使用。推荐配置通义万相 (免费额度较多)。

方式一: 环境变量 (推荐)

# 通义万相 (wanx引擎, 必选其一)
export DASHSCOPE_API_KEY=sk-xxxxxxxxxxxxxxxx

# 火山引擎 (seedream4/seedream5引擎, 可选, 画质更高)
export ARK_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

# DeepSeek (可选, 仅用于 --use-llm 深度意图解析)
export DEEPSEEK_API_KEY=sk-xxxxxxxxxxxxxxxx

方式二: openclaw.json 配置

~/.openclaw/openclaw.json 中添加:

{
  "models": {
    "providers": {
      "wanxiang": { "apiKey": "sk-your-dashscope-key" },
      "ark": { "apiKey": "your-ark-api-key" },
      "deepseek": { "apiKey": "sk-your-deepseek-key" }
    }
  }
}

API Key 获取地址

引擎Key名称获取地址说明
通义万相DASHSCOPE_API_KEYhttps://dashscope.console.aliyun.com/apiKey阿里云百炼平台, 注册后有免费额度
SeedreamARK_API_KEYhttps://console.volcengine.com/ark/region:ark+cn-beijing/apiKey火山引擎, 需开通方舟平台
DeepSeekDEEPSEEK_API_KEYhttps://platform.deepseek.com/api_keys可选, 用于LLM意图解析

健康检查

uv run {baseDir}/scripts/check.py

Workflow

  1. 执行 generate_image_v3.py (优先) 或 generate_image_v2.py (V2兼容)
  2. 解析输出中 MEDIA_URL: 开头的行
  3. 用 markdown 语法展示图片: ![Generated Image](URL)
  4. 如有多张图, 逐一展示所有 MEDIA_URL:
  5. 不下载图片,除非用户要求保存

Legacy

V2脚本 generate_image_v2.py 仍可使用 (无模板/无意图识别):

uv run {baseDir}/scripts/generate_image_v2.py --prompt "描述" --provider auto

V1脚本 generate_image.py 仅支持万相:

uv run {baseDir}/scripts/generate_image.py --prompt "描述" --model wan2.6-t2i

Notes

  • V3自动识别场景并匹配模板, 构建结构化prompt
  • 支持 --use-llm 启用DeepSeek意图解析 (低置信度时)
  • 图片 URL 有效期 24 小时,请及时下载保存
  • Seedream 5.0 lite 支持组图 (≤15张)

Comments

Loading comments...