Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Image Generate
v1.0.0使用内置 image_generate.py 脚本生成图片, 准备清晰具体的 `prompt`。
⭐ 0· 1.6k·138 current·143 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose—generate images using the bundled script—matches the script's behavior. However, the registry metadata declares no required environment variables or dependencies while the script requires an Ark API key (reads MODEL_IMAGE_API_KEY or ARK_API_KEY) and imports the external package 'volcenginesdkarkruntime'. The metadata omission is an incoherence: someone building this skill would legitimately need to declare the API key and the SDK dependency.
Instruction Scope
SKILL.md instructs running python scripts/image_generate.py and documents env var usage (MODEL_IMAGE_API_KEY or ARK_API_KEY, and mentions VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY fallback). The actual script reads MODEL_IMAGE_API_KEY or ARK_API_KEY but does not implement the VOLCENGINE_* fallback claimed in the docs. The script downloads generated images to a local directory (IMAGE_DOWNLOAD_DIR or current directory), which is expected, but the documentation/code mismatch about credential fallback is misleading.
Install Mechanism
There is no install spec (instruction-only with a bundled script) which minimizes installer risk. However, the script imports 'volcenginesdkarkruntime' (an external SDK) but the skill does not declare or provide an installation step for that dependency, so running the script as-is will fail unless that package is preinstalled. This omission is an operational concern.
Credentials
The script requires an API key environment variable (MODEL_IMAGE_API_KEY or ARK_API_KEY) and optionally uses MODEL_IMAGE_NAME and IMAGE_DOWNLOAD_DIR. The registry metadata lists no required env vars or primary credential — that is inconsistent and could mislead users into thinking no secrets are needed. SKILL.md additionally claims a VOLCENGINE_ACCESS_KEY/SECRET fallback, but the code doesn't implement it; asking for extra credentials in docs that aren't used is confusing and suspicious.
Persistence & Privilege
The skill is not always-enabled, does not request elevated or persistent platform privileges, and does not modify other skills or system settings. It runs a local script and writes downloaded images to a directory (configurable).
What to consider before installing
This skill appears to be a simple image-generation helper, but there are gaps you should consider before installing:
- Credentials: The script needs an Ark API key (MODEL_IMAGE_API_KEY or ARK_API_KEY) but the skill metadata does not declare any required env vars. Do not provide sensitive or high-privilege API keys unless you trust the source. Prefer giving a key with limited scope and be prepared to rotate it later.
- Dependency: The script imports 'volcenginesdkarkruntime' but no install instructions are provided. Expect to install that Python package (or the script to fail). Verify the package name and source before pip-installing.
- Documentation mismatch: SKILL.md says it will fall back to VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY, but that fallback is not present in the code. The mismatch suggests the docs and code were not kept in sync — treat the skill as unreviewed and exercise caution.
- File writes and data exposure: The script downloads images returned by the API into IMAGE_DOWNLOAD_DIR (defaults to current directory). Be cautious about where files are written and about any sensitive text you put into prompts (prompt text will be sent to the remote API).
Recommended steps before installing: inspect/verify the Ark SDK package, run the script in an isolated environment (container/VM), supply a low-privilege API key, and confirm the developer/source is trustworthy. If you require the claimed VOLCENGINE fallback behavior, ask the author for a corrected implementation or docs.Like a lobster shell, security has layers — review code before you run it.
latestvk97dvwnkycpv1xkzkgcds5rxhn81ktaq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
