← Back to Skills Marketplace
152
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install xyq
Description
AI 生图/视频创作工具，当用需要生成或者编辑图片、视频，或者查询相关创作的时候使用，触发关键词：pippit、小云雀、xiaoyunque、xyq、生图、生视频
Usage Guidance
This skill will ask you to copy browser session cookies (sid_tt or sessionid_pippitcn_web) and paste them so it can call pippit/xyq APIs, then store those cookies in a local xyq.config.json. Do not paste session cookies into chat unless you fully trust the skill and understand that those cookies grant access to your account on the target service. Consider these options before installing or using the skill:
- Prefer a skill that uses documented API keys with explicit manifest declarations instead of asking for browser cookies in chat. Ask the author to add declared credential requirements to the registry metadata.
- If you must use this skill, do so in an isolated test account (not your primary account) and in an isolated environment/VM so leaked cookies have limited impact.
- Confirm you are comfortable with the skill writing xyq.config.json to the skill directory and how long it will retain credentials. Delete the file and revoke the session on the service when finished.
- Note the helper script requires python3 or uuidgen even though the registry lists no binaries — ensure those are available in a safe environment before running.
If you are not willing to share session cookies or run code that writes persistent credentials, do not install or use this skill.
Capability Analysis
Type: OpenClaw Skill
Name: xyq
Version: 1.0.2
The skill manages sensitive session cookies (sid_tt and sessionid_pippitcn_web) for ByteDance-affiliated image/video services, instructing the agent to store them in a local 'xyq.config.json' file. While this behavior is aligned with the stated purpose of automating these tools, handling raw session cookies is a high-risk practice. Additionally, the script 'scripts/generate_submit_run_body.sh' is vulnerable to string injection because it directly interpolates the user-provided prompt into a Python command string without sanitization.
Capability Assessment
Purpose & Capability
The skill claims to be an AI image/video creation tool and the documented API endpoints (pippit/xyq) align with that purpose. However, the registry metadata declares no required credentials or binaries, while the SKILL.md explicitly requires the user to provide browser cookies (sid_tt or sessionid_pippitcn_web) saved to a local xyq.config.json so the agent can authenticate. Also the provided script implicitly requires python3 or uuidgen to run, yet required binaries is empty. These mismatches between declared requirements and actual needs are concerning.
Instruction Scope
The SKILL.md instructs the agent to (a) ask the user to export browser cookies via devtools and paste them into chat, (b) save those cookies into a local xyq.config.json file, and (c) use those cookies to call internal CMS and API endpoints. Asking users to copy/paste authentication cookies into a chat and storing them is beyond the narrow scope of a simple generation helper and constitutes collection of sensitive credentials. The instructions also direct spawning subagents to poll generation threads and to create/modify the local config file.
Install Mechanism
No install spec — instruction-only plus a small helper shell script are present. The script is straightforward and will be executed locally; there is no network download or external install of code. This is a lower install risk, but execution requires local shell/python capabilities.
Credentials
Rather than using declared environment variables or documented API keys, the skill requires sensitive session cookies (sid_tt or sessionid_pippitcn_web) derived from the user's browser. Those cookies are not listed in registry requirements. Requesting users to paste cookies into chat and storing them in a local file is disproportionate and risky because cookies are equivalent to session tokens and grant access to the user's account on the referenced services.
Persistence & Privilege
The skill does write a local config file (xyq.config.json) in its directory to persist cookies and user/workspace ids; this is a limited, local persistence and 'always' is false. It does not request system-wide privileges or modify other skills. Autonomous invocation and subagent spawning are allowed by default but are not elevated here — still, they increase the blast radius if credentials are present.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xyq - After installation, invoke the skill by name or use
/xyq - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
No functional or documentation changes were detected in this version.
- Version 1.0.2 release with no file or documentation updates.
v1.0.1
xyq 1.0.1 Changelog
- 配置文件路径从用户目录（~/.xyq/xyq.config.json）调整为本文件同目录下的 xyq.config.json。
- 所有关于 config.json 路径及描述已同步修改为新路径表达。
- 优化了区域自动推断与配置文件完整性判断的描述。
- 明确用户生图/生视频任务结果通知时需以 markdown 格式回复产物链接。
v1.0.0
xyq 1.0.0
- 首发版本，提供 AI 驱动的图片/视频生成与编辑能力，支持“海外”和“国内”两大区域
- 智能识别区域：基于关键词、链接、配置文件等自动判断目标区域，灵活切换 API 和 Cookie 策略
- 支持图/视频生产流程：引导用户补全图片/视频意图，异步处理并轮询生成结果，产物实时反馈
- 简化密钥管理：交互式获取与更新 cookie，自动维护本地 config 文件中的身份信息
- 兼容历史链接解析：提取主键参数，便捷获取/跟踪生成任务状态
- 提供详细接口调用说明与参数管理逻辑，便于后续扩展
Metadata
Frequently Asked Questions
What is xyq?
AI 生图/视频创作工具，当用需要生成或者编辑图片、视频，或者查询相关创作的时候使用，触发关键词：pippit、小云雀、xiaoyunque、xyq、生图、生视频. It is an AI Agent Skill for Claude Code / OpenClaw, with 152 downloads so far.
How do I install xyq?
Run "/install xyq" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is xyq free?
Yes, xyq is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does xyq support?
xyq is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created xyq?
It is built and maintained by imaoda (@imaoda); the current version is v1.0.2.
More Skills