Sih Ai Photo Editor

AI图片编辑工具，支持自然语言驱动的换装、换背景、换脸、风格转换（动漫/粘土/油画等）、美颜修图。当用户需要AI图片处理、人像编辑、背景替换、风格迁移、服装更换、脸部融合时使用此skill。支持用户通过描述性prompt（如"把衣服换成bikini"、"背景换成海边"、"转换成动漫风格"）进行图片编辑。

Summary of what to consider before installing: - Do not assume the embedded API key is safe. The package includes a hardcoded API key in scripts/config.py. That key could be valid and might be used for API calls and billing. Ask the publisher to remove embedded keys and require a user-provided SIH_API_KEY via environment variable instead. If you proceed, rotate or revoke that key (and avoid using it for sensitive accounts). - Expect images and prompts to be sent to a third-party endpoint (api.vwu.ai). If you have privacy or legal concerns (face swaps, celebrity likenesses, or sensitive images), do not send those images. - The skill writes persistent files under ~/.sih_ai/ (user ID, usage_history.jsonl) and downloads outputs to ~/Desktop/Sih_Ai_Results/ and will attempt to open Finder/Preview on macOS. If you don't want that behavior, inspect/modify the scripts before use. - Metadata omits required credentials. Confirm with the author how API keys should be supplied and insist on explicit required env vars in the skill manifest. - If you don't trust the publisher or cannot verify the API key owner, do not install. If you need the functionality, request a version without embedded secrets and with clear consent for uploading images, or run the scripts in an isolated environment after reviewing/overriding the default key.

Type: OpenClaw Skill Name: sih-ai-photo-editor Version: 1.0.1 The skill bundle contains a hardcoded API key in 'scripts/config.py' and instructions in 'SKILL.md' directing the AI agent to perform high-privilege OS operations, such as creating directories in '~/Desktop' and executing commands to open Finder and the Preview app. While these capabilities are intended for the 'automatic download and preview' feature, they expand the agent's attack surface. Additionally, 'scripts/quota_checker.py' creates a hidden local directory ('~/.sih_ai') to track user state and history. No evidence of intentional malice or data exfiltration was found, but the combination of hardcoded credentials and OS-level instructions warrants a suspicious classification.