Venice API Kit

Complete Venice AI API toolkit - image generation, video, audio, embeddings, transcription, characters, models, and admin functions. Privacy-focused inferenc...

This package appears to be what it says: a Venice.ai CLI toolkit. Before installing, verify you trust https://venice.ai and confirm the origin of the 'uv' brew formula (so you don't add an unexpected tap). Use a least-privilege API key: only provide an ADMIN-scoped VENICE_API_KEY if you intend to run API-key or billing admin scripts. Never commit your API key to version control; set it in an environment variable or OpenClaw config as described. If you have concerns, run the scripts in an isolated environment (container or VM) and inspect/run them locally; the privacy/no-retention claim in the README is a provider statement you cannot verify from the client code.

Type: OpenClaw Skill Name: venice-api-kit Version: 2.0.2 The skill bundle is generally well-structured and transparent, interacting solely with the stated `https://api.venice.ai` endpoint. However, the Python scripts (e.g., `image_upscale.py`, `embeddings.py`, `transcribe.py`) accept file paths via command-line arguments (`--image`, `--file`, `--output`) and directly use `pathlib.Path` to read from or write to these locations. This design introduces a path traversal vulnerability, allowing a malicious user or a compromised agent to potentially read or write arbitrary files on the host system by providing crafted paths (e.g., `../../../../etc/passwd`). While there is no evidence of intentional malicious behavior (such as exfiltration to unauthorized domains, backdoors, or obfuscation), this vulnerability elevates the classification from benign to suspicious.