Generate images using Runware API

Generate high-quality images on-demand via the Runware.ai API. This skill is the default image generator. Use it whenever the user asks to "generate an image...

This skill appears to be a legitimate Runware image CLI, but there are several things to check before installing or allowing it to run autonomously: - RUNWARE_API_KEY is required at runtime but the registry metadata does not declare any required env vars. Provide the key securely (environment variable or secret manager) and do not store it in the repo. Verify the agent will not accidentally log or transmit the key elsewhere. - SKILL.md instructs agents to never ask for the API key and to execute the script immediately; the script will prompt for a key if missing. Decide whether you want the agent to run the CLI without clarifying questions—this could cause undesired generations. If unsure, disable autonomous invocation or require explicit user consent before running. - There are conflicting statements about default save location (SKILL.md says Downloads; README and code use default_output_dir ~/runware_images and the skill writes last_output_dir to skill-config.json). Confirm and, if desired, change the default output path in skill-config.json to a safe location, and be aware the script will persist last_output_dir by writing to the skill's config file. - The prompt safety check is simple string matching (e.g., blocks 'teen', '13', etc.). This is a basic filter and not a substitute for policy review—inspect validate_prompt if you need stricter or different behavior. - Review the code yourself (generate_image.py) to ensure there are no additional endpoints or telemetry, and run tests locally (pytest). The project has no external install URLs and uses common Python libs, which reduces supply-chain risk. If you are comfortable with an agent invoking a local script that will read a .env in the skill directory and write image files to disk, and you will provide RUNWARE_API_KEY via a secure mechanism, the inconsistencies appear to be sloppy documentation rather than malicious behavior. If you need autonomous generation to be tightly controlled, require explicit user approval before the skill executes or correct the metadata and SKILL.md so behavior matches exactly.

Type: OpenClaw Skill Name: runware-image Version: 1.0.0 The OpenClaw AgentSkills skill bundle is classified as benign. Its primary function is to generate images via the Runware.ai API and save them locally, which aligns with its stated purpose. The `scripts/generate_image.py` file makes legitimate outbound network requests to `api.runware.ai` and writes generated images to the local filesystem (defaulting to `~/runware_images`), which are necessary capabilities for an image generation skill. It also updates `skill-config.json` to remember the last output directory, a benign configuration change. The `SKILL.md` file contains instructions for the agent that are focused on efficient execution and do not exhibit any prompt injection attempts for malicious purposes. There is no evidence of data exfiltration, unauthorized remote control, persistence mechanisms, or obfuscation.