by 安全扫描
OpenClaw
可疑
high confidenceThe skill's instructions match its stated purpose (generate images via DashScope and upload to catbox) but there are clear inconsistencies and a risky example secret in the SKILL.md that the author did not declare in the registry metadata.
评估建议
This skill appears to do what it says (call Alibaba DashScope to generate images and upload them to catbox.moe) but there are a few things to check before installing: 1) The SKILL.md requires DASHSCOPE_API_KEY but the registry metadata lists no required env vars — ask the publisher to correct the metadata so you know beforehand what secret will be used. 2) SKILL.md contains a literal-looking API key in an example; do not assume it is safe. Treat it as a possible leaked secret and ask the maintai...详细分析 ▾
⚠ 用途与能力
The skill's description and SKILL.md consistently describe calling Alibaba DashScope (wan2.6-t2i) and uploading results to catbox.moe — that is coherent. However the registry metadata lists no required environment variables while the SKILL.md explicitly requires DASHSCOPE_API_KEY. The missing declaration is an incoherence that affects user expectations of needed credentials.
⚠ 指令范围
The instructions are concrete (curl to DashScope, download to ~/Desktop, upload to catbox.moe) and stay within the stated purpose. Concerns: (1) SKILL.md includes a literal-looking API key (sk-ec7...), which may be a real secret or a placeholder — embedding keys in docs is risky; (2) the instructions write files to the user's Desktop and upload them to a third-party public host (catbox.moe) without asking for explicit consent in the flow; (3) the guide assumes presence of python3 and standard paths but the registry did not declare those prerequisites.
✓ 安装机制
Instruction-only skill with no install steps and no code files — low install risk.
⚠ 凭证需求
Only one credential (DASHSCOPE_API_KEY) is needed according to the SKILL.md which is proportionate. But the registry claims no required env vars, creating an inconsistency. The embedded example API key is an additional risk (possible accidental secret disclosure). No other unrelated credentials are requested.
✓ 持久化与权限
always is false and the skill does not request persistent system-level privileges or modify other skills' configuration. Autonomous invocation is allowed (platform default) but not combined with other high-risk indicators here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/1
wan-image-gen v1.0.0 - Initial release of the wan-image-gen skill. - Generates images using Alibaba DashScope wan2.6-t2i model. - Downloads generated images directly to the user’s Desktop. - Uploads images to catbox.moe for a public, shareable link. - Includes step-by-step example workflow and error handling tips.
● 可疑
安装命令
点击复制官方npx clawhub@latest install wan
镜像加速npx clawhub@latest install wan --registry https://cn.longxiaskill.com