📦 Lux3D 3D Model Generator — 图生3D
v1.1.0调用 Lux3D 将任意 2D 图片一键转换为可下载的 3D 模型，支持 OBJ/GLB 格式，自动识别主体并补全几何与纹理，适合快速建模、原型展示及 AR/VR 内容制作。
2· 297·1 当前·1 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceThe package mostly implements a legitimate 2D→3D client, but there are inconsistencies (missing declared env var, unknown source/homepage, and some questionable security choices) that you should understand before installing or trusting it with sensitive images or keys.
评估建议
Before installing or using this skill:
- Expect to provide an API key in LUX3D_API_KEY (base64 invitation code). The registry metadata incorrectly states no required env vars — confirm this before trusting the package.
- The client sends your image (base64) to https://api.luxreal.ai; do NOT send sensitive or private images unless you trust that remote service and its privacy policy.
- Verify the origin: the skill has no homepage and source is 'unknown'. The SKILL.md points to a GitHub repo an...详细分析 ▾
ℹ 用途与能力
The code and SKILL.md implement a 2D-image→3D-model workflow that matches the skill name and description. However the registry metadata claims no required environment variables or credentials while the code and documentation clearly require a LUX3D_API_KEY environment variable (a base64 invitation code). The lack of a declared required env var in the metadata is an inconsistency and reduces transparency about what this skill needs.
✓ 指令范围
The instructions and included client focus on submitting an image, polling for results, and downloading a model. The runtime only accesses the specified image file(s), environment variable LUX3D_API_KEY, and writes the output file. It sends base64-encoded image data to an external API (api.luxreal.ai) which is expected for this functionality. There are no instructions to read unrelated system files, shell history, or other credentials.
✓ 安装机制
This is an instruction-only skill with an included Python client; there is no install spec that downloads arbitrary code. The SKILL.md recommends installing standard pip packages (Pillow, requests). That is low-risk compared with remote archive downloads. Note: because there's no automated install spec the environment must already have these dependencies or the user must install them manually.
⚠ 凭证需求
The client requires a LUX3D_API_KEY (base64 invitation code containing ak/sk/appuid) to operate. The registry metadata lists no required env vars or primary credential, which is inconsistent and misleading. Apart from that, the set of secrets requested is limited and coherent for an external API client (one API key).
✓ 持久化与权限
The skill does not request permanent/always-on presence, does not declare elevated platform privileges, and does not modify other skills or system-wide settings. It runs as a normal client invoked by the agent.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/13
Security enhancements: API key validation, input/output validation, secure requests with retry logic, timeout protection, and comprehensive documentation
● 无害
安装命令
点击复制官方npx clawhub@latest install lux3d
镜像加速npx clawhub@latest install lux3d --registry https://cn.longxiaskill.com