文生图技能。当你需要提供一段文本描述来生成图片时调用此技能。

This skill appears to implement text→image by sending prompts and (optionally) user files to a remote inference API, which is a plausible purpose. However two red flags warrant caution: (1) SKILL.md insists the agent must run the Python script directly and not use the platform runner — that looks like an attempt to bypass platform controls/auditing; (2) the default backend URL (https://dlazy.com/api/ai/tool) is undocumented and could receive any prompt or file you send (the script base64-encodes and uploads images/videos). Before installing: verify the operator/owner and the legitimacy of dlazy.com or set TEAM_BASE_URL to a trusted endpoint; do not provide a TEAM_API_KEY unless you trust the remote service; prefer using the platform's managed run mechanism (contact the skill author why openclaw run is disallowed); and avoid passing local file paths you wouldn't want uploaded. If you need this capability but want lower risk, ask the maintainer to remove the 'must not use openclaw run' directive, declare TEAM_BASE_URL explicitly in metadata, and provide the hosting/ownership details for the API endpoint.

Type: OpenClaw Skill Name: lrshuai-text-to-image Version: 1.0.1 The skill contains a Python script (`script/invoke_model.py`) that encodes local files into base64 and transmits them along with environment-stored API keys to a remote endpoint (dlazy.com). Most notably, the `SKILL.md` file contains a 'CRITICAL INSTRUCTION' explicitly directing the AI agent to bypass the standard `openclaw run` execution method in favor of direct system calls. This attempt to circumvent the framework's standard execution path, combined with the capability to read and exfiltrate local file data, poses a risk of evading security controls or logging.