Yearbook Photo Skill — 年鉴照片技能
v1.6.0年鉴照片制作技能，帮助创建精美的年鉴照片，支持多种滤镜和排版效果。
0· 164·0 当前·0 累计
by 下载技能包
最后更新
2026/3/27
安全扫描
OpenClaw
安全
high confidenceThis is an internally consistent yearbook-style image-generation skill that legitimately requires a single Neta API token and only calls the provider's image APIs; the only notable issue is a metadata mismatch where the registry listing doesn't advertise the required token while the package and runtime do.
评估建议
This skill appears to do what it claims: generate yearbook-style images via a Neta/TalesOfAI API. Before installing: (1) Confirm the required env var NETA_TOKEN is present and valid (the package declares it required even though the registry summary omitted it). (2) Verify you trust the API endpoint (the code calls https://api.talesofai.cn) and are comfortable sending prompt text and the token to that host. (3) Do not paste your token into public logs or public prompts; prefer environment variabl...详细分析 ▾
✓ 用途与能力
Name, README, SKILL.md, package.json and the included yearbookphoto.js all align: the skill generates images via a Neta/TalesOfAI API and requires an API token. The network calls (POST to /v3/make_image and polling /v1/artifact/task) are consistent with image generation.
✓ 指令范围
SKILL.md and the script only instruct usage of a token and running the Node script; there are no instructions to read unrelated files, other credentials, system config, or to transmit data to unexpected third parties beyond the image API endpoints used in the code.
✓ 安装机制
No install spec is provided (instruction-only with an included Node script). There are no downloads from arbitrary URLs or extraction steps in the package; recommended install via npx/clawhub is a packaging convenience, not an opaque installer.
ℹ 凭证需求
The skill requires a single credential (NETA_TOKEN) which is appropriate for an API-backed image generator. However, the registry metadata at the top of the submission lists no required env vars while package.json and SKILL.md both state NETA_TOKEN is required — this metadata mismatch should be corrected/confirmed before installation.
✓ 持久化与权限
The skill does not request persistent/always-on privileges, does not modify other skills or system-wide settings, and is user-invocable only. Default autonomy settings are unchanged (normal for skills) but do not materially increase risk here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.6.02026/3/25
yearbook-photo-skill v1.6.0 - Updated documentation to require a Neta API token, with information on obtaining a free trial. - Updated usage instructions to include new --token parameter for API authentication. - Clarified API provider as "Neta AI image generation API". - Improved quick start guide and command examples for clarity.
● 无害
安装命令
点击复制官方npx clawhub@latest install yearbook-photo-skill
镜像加速npx clawhub@latest install yearbook-photo-skill --registry https://cn.longxiaskill.com 镜像可用