Volcengine Ai

火山引擎AI生成与理解API。让Agent能够调用火山引擎方舟的AI能力：图片生成(Seedream-5.0-lite)、视频生成(Seedance-1.5-pro)、图片理解、视频理解。使用前需配置API密钥(VOLCENGINE_API_KEY)。支持异步任务查询。

This SKILL.md appears to be an instruction-only integration for Volcengine's visual APIs, but there are several red flags you should address before using it: - Do not copy the example API key from the README into your environment; treat it as potentially leaked or just a placeholder. Replace with your own key only after verifying the skill. - The registry metadata did not declare VOLCENGINE_API_KEY as a required credential — confirm with the skill author or source that the skill truly needs that env var and update metadata accordingly. - Verify the API endpoint domain and URL paths in the curl examples. The paths contain spaces (likely typos) and the hostname (ark.cn-beijing.volces.com) is unusual; confirm these point to the official Volcengine API endpoints. - Avoid storing secrets in plaintext files like ~/.bashrc if you can; use a secrets manager or at least limit file permissions and consider session-only environment variables. - If you need higher confidence: ask the publisher for an official homepage/source repo, corrected SKILL.md with placeholders (not real keys), and an updated registry manifest declaring VOLCENGINE_API_KEY as required. If the publisher cannot provide these, treat the skill as suspicious and avoid installing.

Type: OpenClaw Skill Name: volcengine-ai Version: 1.0.0 The skill bundle contains a hardcoded API key (222b33d4-f22f-4f99-b68f-0eb9150ab507) and explicitly instructs the agent in `SKILL.md` to persist this key by appending it to the user's `~/.bashrc` file. While the API endpoints for Volcengine appear legitimate, providing a pre-configured key is a significant privacy risk as it allows the key owner to monitor all data and prompts sent to the service, and modifying shell configuration files is an invasive persistence mechanism.