← Back to Skills Marketplace
134
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install uni-image
Description
Unified multi-platform AI image generation. Supports Volcengine Seedream, Alibaba Qwen Image, and Google Gemini (Nano Banana). Switch between models with a d...
Usage Guidance
Do not install or run this skill yet. The package is missing the referenced JavaScript files and run-time declarations are inconsistent (it expects you to run node but 'node' is not declared and the code is not included). Before using: 1) Verify the source: visit the provided homepage repository and confirm the uni-image-proxy.js and uni-image-inject.js files exist and match the published package. 2) Inspect those scripts thoroughly to ensure they do not exfiltrate keys or send data to unexpected endpoints (check all network destinations and file writes). 3) Prefer setting provider keys as environment variables rather than pasting them into a UI you don't control; if the skill stores keys to ~/.openclaw-dev/uni-image-config.json, inspect that file's contents and access controls. 4) Confirm you trust the author and the code (or run it in a sandboxed environment) before supplying any API keys. If you can't inspect the missing code or the repo doesn't match, consider this package incomplete/untrustworthy.
Capability Analysis
Type: OpenClaw Skill
Name: uni-image
Version: 1.0.0
The skill is classified as suspicious because it describes a high-risk architecture involving a fetch interceptor and a local proxy server (port 18800) to handle sensitive API keys. It references non-existent or future-dated AI models (e.g., 'Gemini 3.1' and 'Nano Banana') and contains a future-dated timestamp in `_meta.json` (year 2026), which suggests deceptive intent. Furthermore, the `SKILL.md` instructions suggest executing a script located outside the skill's expected directory (`../../uni-image-proxy.js`), which is a potential path traversal risk.
Capability Assessment
Purpose & Capability
The declared purpose (multi-provider image generation) matches the three API keys requested (Volcengine ARK, DashScope, Google), which is reasonable. However the SKILL.md lists implementation files (uni-image-proxy.js, uni-image-inject.js) and run instructions, but no code files are included in the package. That inconsistency suggests the published skill is incomplete or mispackaged.
Instruction Scope
Runtime instructions tell the agent/user to run a local Node-based HTTP proxy on port 18800 and state keys are stored at ~/.openclaw-dev/uni-image-config.json. The instructions therefore imply writing/reading local files and making network calls to provider APIs. Those actions are expected for a proxy, but the skill also declares required env vars while simultaneously describing a UI-based key storage — the behavior around how keys are supplied/used is ambiguous.
Install Mechanism
There is no install spec (instruction-only), which normally lowers risk. But the SKILL.md expects running node and local JS files; yet no binaries (node) are declared and the referenced JS files are missing. That mismatch is an integrity/problem-of-omission risk (the package is incomplete).
Credentials
Requested environment variables (ARK_API_KEY, DASHSCOPE_IMAGE_KEY, GOOGLE_API_KEY) are proportional to the stated multi-provider image generation function. The ambiguity: the skill requires these env vars but also instructs storing keys in a local JSON file and using a UI — it's unclear which is actually required at runtime.
Persistence & Privilege
The skill instructs storing API keys in ~/.openclaw-dev/uni-image-config.json, which creates persistent credentials on disk. The skill is not always-enabled and does not request elevated system privileges, but persistence of secrets on disk is a sensitive behavior and should be verified (inspect the code that writes/reads that file).
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install uni-image - After installation, invoke the skill by name or use
/uni-image - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of UniImage: unified multi-platform AI image generation.
- Supports Volcengine Seedream, Alibaba Qwen Image, and Google Gemini (Nano Banana) providers.
- Add dropdown selector on the paint page for easy switching between image generation models.
- Proxy server routes requests to the appropriate provider API based on model selection.
- API key configuration via UI or environment variables.
- Includes CLI usage examples and setup instructions.
Metadata
Frequently Asked Questions
What is uni-image?
Unified multi-platform AI image generation. Supports Volcengine Seedream, Alibaba Qwen Image, and Google Gemini (Nano Banana). Switch between models with a d... It is an AI Agent Skill for Claude Code / OpenClaw, with 134 downloads so far.
How do I install uni-image?
Run "/install uni-image" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is uni-image free?
Yes, uni-image is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does uni-image support?
uni-image is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created uni-image?
It is built and maintained by 以码悟道 (@sangjiexun); the current version is v1.0.0.
More Skills