by 安全扫描
OpenClaw
可疑
medium confidenceThe skill generally matches its stated purpose (generate images with Ollama and send via WhatsApp) but has several incoherences and surprising pieces (undeclared binary requirements, extra FastAPI endpoints that post externally, and hard-coded agent paths) that warrant caution before installing.
评估建议
This skill mostly does what its SKILL.md says (use Ollama to generate images and deliver them via a WhatsApp channel), but there are several red flags you should address before installing: 1) The package fails to declare required binaries (ollama and python3) — ensure these are present and expected. 2) The bundle contains FastAPI endpoints (generate_image.py and whatsapp_integration.py) that are not mentioned in the SKILL.md; review those files carefully and do not run them unless you understand...详细分析 ▾
⚠ 用途与能力
The SKILL.md and the code files align on using Ollama to generate images and sending them to WhatsApp, but the registry metadata claims no required binaries or env vars while runner.py clearly calls the 'ollama' CLI and the SKILL.md requires python3 and a TTY. The package omits declaring these required executables (ollama, python), which is an incoherence that could hide unmet runtime assumptions.
⚠ 指令范围
The runtime instructions (run runner.py with pty=true and then use an internal message tool to send the generated file) are narrowly scoped and plausible. However, the bundle also contains FastAPI-based endpoints (generate_image.py and whatsapp_integration.py) that are not referenced in SKILL.md. whatsapp_integration.py performs an external POST to https://api.whatsapp.com/send, which is a web endpoint (not the documented WhatsApp Business API) and could result in data being transmitted externally if those endpoints are run. These extra server endpoints widen the skill's effective behavior beyond the documented instruction-only flow.
✓ 安装机制
There is no install spec (instruction-only), so nothing is automatically downloaded or extracted. That minimizes supply-chain risk. The remaining risk comes from included code files which, if executed by the agent, will run subprocesses and make network requests.
⚠ 凭证需求
The skill declares no required env vars or credentials, but generate_image.py supports OLLAMA_URL and OLLAMA_IMAGE_MODEL via environment variables (with safe defaults). More importantly, sending to WhatsApp normally requires credentials or a proper API; whatsapp_integration.py sends JSON to api.whatsapp.com without any auth, which is suspicious and inconsistent with a legitimate WhatsApp integration. Also SKILL.md hardcodes absolute agent-specific paths (/Users/openclaw/.openclaw/...), reducing portability and revealing host-path assumptions.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide configurations. It contains server code that could be run, but nothing in the metadata asks for persistent installation or elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/10
- Initial release of the skill. - Generates images using the Ollama `x/z-image-turbo` model (macOS only). - Automatically sends the generated image to WhatsApp with a caption. - Supports custom generation parameters (size, steps, seed, negative prompt). - Requires a local Ollama instance running on macOS with the corresponding model installed.
● 无害
安装命令 点击复制
官方npx clawhub@latest install ollama-x-z-image-turbo
镜像加速npx clawhub@latest install ollama-x-z-image-turbo --registry https://cn.clawhub-mirror.com
技能文档
Description
Génère des images via Ollama (modèlex/z-image-turbo) et les envoie sur WhatsApp.Déclenchement
Quand l'utilisateur demande de générer/créer/dessiner une image (ou variantes), suivre ces étapes :Étape 1 — Générer l'image
Exécuter viaexec avec pty=true (obligatoire) :
python3 /Users/openclaw/.openclaw/skills/ollama-x-z-image-turbo/runner.py \
--prompt "" \
--width 1024 --height 1024 --steps 20 \
--out /Users/openclaw/.openclaw/workspace/tmp/ollama_image.png -v
Important :
pty=trueest obligatoire (Ollama nécessite un TTY)timeout=120minimum recommandé- Ajuster
--width,--height,--stepsselon la demande
Étape 2 — Envoyer sur WhatsApp
Utiliser l'outil message :action: send
channel: whatsapp
to:
message:
filePath: /Users/openclaw/.openclaw/workspace/tmp/ollama_image.png
Paramètres disponibles
| Paramètre | Défaut | Description |
|---|---|---|
| --prompt | requis | Description de l'image |
| --width | 1024 | Largeur en pixels |
| --height | 1024 | Hauteur en pixels |
| --steps | 20 | Étapes de débruitage |
| --seed | aléa | Graine pour reproductibilité |
| --negative | aucun | Prompt négatif |
| --timeout | 300 | Timeout en secondes |
Exemples de demandes utilisateur
- "Génère une image d'un chat astronaute"
- "Crée-moi une illustration d'un coucher de soleil"
- "Dessine un robot dans une forêt"
- "Fais une image de …"
Prérequis
- Ollama actif sur
http://127.0.0.1:11434 - Modèle installé :
x/z-image-turbo:latest
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制