by 安全扫描
OpenClaw
安全
high confidenceThe skill and its files are internally consistent with an image-generation client for Volcengine (Jimeng); the requested binaries and env vars match the declared purpose and there is no unexplained access or suspicious install behavior.
评估建议
This skill appears to be a straightforward Node.js client for Volcengine '即梦' image generation. Before installing/using: 1) Understand that all prompts and any image URLs you supply will be sent to volcengine (visual.volcengineapi.com) and the generated images will be downloaded — do not send private or sensitive images or prompts you do not want sent to an external service. 2) Provide dedicated API keys with the minimum necessary privileges and monitor usage/billing (the service bills per outpu...详细分析 ▾
✓ 用途与能力
Name/description match the implementation: the skill is a Node.js client for Volcengine '即梦' image-generation (jimeng) and correctly requires node and the service Access/Secret keys. Required items (node, JIMENG_ACCESS_KEY, JIMENG_SECRET_KEY) are proportionate and expected.
✓ 指令范围
SKILL.md instructs running the included Node script which reads only the declared env vars, sends prompts/optional image URLs to the official visual.volcengineapi.com endpoints, polls for results, and can save returned images to disk. The script makes network requests to the vendor and to image URLs returned by the service (for downloads) — this is expected for the stated purpose.
✓ 安装机制
No install spec and the package is implemented as a single Node script using only built-in Node modules (crypto, https, fs, etc.). Nothing is downloaded from arbitrary or obscure URLs and no archive extraction or package manager installs are required.
✓ 凭证需求
Only two env vars are required (ACCESS and SECRET) which are exactly the credentials needed to sign requests to the service. No unrelated secrets or system credentials are requested.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills or system settings, and is user-invocable. It runs on-demand and does not demand persistent elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/17
Initial release: Jimeng AI image generation based on Volcengine 4.0 async API. Supports text-to-image, image-to-image, font design poster mode, up to 4K resolution, AI auto ratio inference. Zero dependencies, pure Node.js built-in modules.
● 无害
安装命令
点击复制官方npx clawhub@latest install jimeng-image-gen
镜像加速npx clawhub@latest install jimeng-image-gen --registry https://cn.longxiaskill.com