pic-gen

AI 图片生成与提示词优化工具。支持通义万相、Banana (Flux)、DALL-E 等多模型。用于：根据用户简单描述生成高质量图片提示词、优化已有提示词、直接调用配置好的模型出图。触发场景：「生成图片」「画一个 XXX」「优化这个提示词」「设置 API key」「切换模型」。用户可直接发送密钥给 bot，自动...

This skill appears to implement the advertised features (prompt optimization and calling Qwen/Banana/OpenAI image APIs), but there are a few things to consider before installing: 1) Metadata mismatch — the registry says no env vars are required but the code expects DASHSCOPE_API_KEY, BANANA_API_KEY, and OPENAI_API_KEY (or keys in config/models.yaml). 2) The skill asks users to paste API keys into chat and will write them to pic-gen/config/models.yaml; avoid pasting secrets into public or semi-public chats and avoid committing that file to source control. Prefer setting keys via environment variables or a secure secrets manager instead. 3) Because the skill persists keys, review the code (scripts/update_config.py, scripts/*.py) to confirm no unexpected network endpoints or exfiltration; the listed network calls target known APIs (dashscope.aliyuncs.com, api.banana.dev, api.openai.com). 4) If you install, run it in a sandboxed environment, keep API keys minimal-scoped where possible, and consider manually setting environment variables rather than providing keys via chat. If you want higher assurance, ask the author to: (a) update registry metadata to declare required env vars and dependencies, and (b) remove the recommendation to paste keys into chat or add an explicit confirmation mechanism and clear audit/log guidance.

Type: OpenClaw Skill Name: pic-gen Version: 1.1.0 The pic-gen skill bundle is a well-structured tool for AI image generation and prompt optimization across multiple platforms (Qwen, Banana/Flux, DALL-E 3). The bundle includes Python scripts for API interaction, prompt enhancement logic, and configuration management. While the skill handles sensitive API keys, it follows security best practices by supporting environment variables, implementing key masking in the configuration display script (update_config.py), and providing explicit warnings to users about not sharing secrets. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.