万相 2.6 生成微信公众号封面图

使用阿里云万相 2.6 模型生成微信公众号封面图和技术架构设计图

This skill appears to implement the advertised image-generation features, but there are two practical concerns to weigh before installing: (1) the registry metadata omits that you must provide an API key—the code expects DASHSCOPE_API_KEY (and will also accept QWEN_API_KEY / ALIYUN_DASHSCOPE_API_KEY); verify the skill metadata is updated so you understand what secrets are required; (2) the runtime will load shared env files (OPENCLAW_ENV_FILE, ~/.openclaw/.env, ~/.workbuddy/.env) to locate keys. If those files contain credentials for other services, the skill could read them. Recommended actions: inspect the code locally (you already have it), provide the API key via a dedicated .env in the skill folder or explicit --api-key when invoking, avoid placing unrelated secrets in shared ~/.openclaw/.env or ~/.workbuddy/.env, and run the tool in a sandboxed environment if you cannot fully trust the author. If you need higher assurance, ask the maintainer to update registry metadata to declare DASHSCOPE_API_KEY as a required env var and to avoid loading unrelated shared env files by default.

Type: OpenClaw Skill Name: wan26-text-to-image Version: 1.0.0 The skill bundle is a legitimate tool for generating images using Alibaba's Wanxiang 2.6 API. It follows security best practices by managing API keys through local .env files with restricted permissions (chmod 600) and explicitly avoids printing sensitive credentials to the console in setup.sh and config.py. The core logic in wan26_generator.py is transparent, using the official dashscope SDK and standard requests library to download generated images to a designated local directory (~/WorkBuddy/), with no evidence of data exfiltration, malicious execution, or harmful prompt injection.