wan-image-gen

基于阿里云百炼 Wan 图像生成模型的生图 skill。支持文生图任务提交、轮询任务状态、下载生成图片到本地。 当用户需要根据提示词生成图片、批量出图、指定尺寸或继续查询已有图片生成任务时，使用此 skill。

This skill appears to do what it claims: it needs a DashScope/Aliyun API key (DASHSCOPE_API_KEY) and Node.js, then it will submit image-generation tasks to the configured baseUrl and download images into an outputs/ folder. Before installing: (1) verify DASHSCOPE_API_KEY is a key you intend to use here and not a higher-privilege secret; (2) check config.json (if you create one) for accidentally-stored secrets or a modified baseUrl — point it to the official endpoint (dashscope.aliyuncs.com) if you trust Aliyun; (3) be aware the script will create/write files under its outputs/ directory; (4) if you see unexpected network endpoints in your copy of the code or config, do not run it and rotate any exposed keys. If you want extra assurance, run the script in an isolated environment (container) and inspect network requests (or review the full script) before providing real API credentials.

Type: OpenClaw Skill Name: wan-image-gen Version: 0.1.1 The wan-image-gen skill is a legitimate tool for generating images using Aliyun's DashScope API. The main script, scripts/wan-image-gen.js, implements task submission, status polling, and image downloading with appropriate filename sanitization to prevent path traversal. It communicates exclusively with the official Aliyun endpoint (dashscope.aliyuncs.com) and handles sensitive API keys through standard environment variables or local configuration files. No evidence of data exfiltration, malicious execution, or prompt injection was found.