图片视频生成

可调用 banana、sora、veo 等模型生成图片视频，适合图片、视频与短剧素材生产。

This skill mostly does what it says — it uses a relay service (easyclaw.bar) to submit generation requests and sets up a watcher to poll for results — but there are important caveats: - The registry metadata did not declare the required environment variables, but the scripts require a platform token or API key/secret (EASYCLAW_PLATFORM_API_TOKEN, or fallback names). Do not configure secrets until you trust the relay operator. - The skill will create OpenClaw cron watcher jobs and write watcher state and session transcripts under ~/.openclaw. That means a persistent background task will exist and the platform credentials may be embedded into the watcher configuration/CLI args. If you prefer not to persist tokens, do not enable the watcher (use --no-watch) or run the skill in an isolated environment. - The relay host (http://easyclaw.bar) is not documented in the skill metadata beyond SKILL.md; verify the operator and privacy/security policies of that service before sending prompts, files, or credentials. The platform also logs relay requests and may inject upstream Bearer tokens per the docs — that implies the relay mediates traffic to upstream providers. Recommendations before installing: - Inspect the scripts locally (you already have them) and confirm you are comfortable with files written under ~/.openclaw and with scheduled cron jobs. - If you must test, do so in an isolated user account or VM, and avoid using high-privilege or long-lived credentials. Prefer short-lived or scoped credentials if available. - Ask the skill author for a clear statement of where credentials are stored, how cron jobs are registered (what exact command is scheduled), and whether tokens are persisted in dotfiles or job definitions. If you want, I can point out the exact lines where tokens are read, where they are passed to cron scheduling, and where files under ~/.openclaw are written so you can audit them more easily.

Type: OpenClaw Skill Name: tupian-shipin-shengcheng Version: 1.0.0 The skill bundle exhibits high-risk behavior by performing extensive environment discovery and interacting directly with the host application's internal state. Specifically, `scripts/schedule_task_watch.py` and `scripts/cron_watch_task.py` search for local OpenClaw/EasyClaw installations, execute CLI commands via `subprocess.run`, and manually modify session transcript files to inject background notifications. Furthermore, the skill handles credentials insecurely by passing API tokens as command-line arguments to cron jobs, exposing them to system process monitoring. While these actions facilitate asynchronous video/image generation via the `easyclaw.bar` platform, the intrusive methods used—such as reading the global `openclaw.json` configuration and session stores—exceed the typical boundaries of a benign skill.