Side-by-side comparison of paid vs local image generation models — DALL-E 3, FLUX.1-schnell, Gemini Imagen, and others. Generates images from the same prompt...

This skill does what it says (compare image generators), but take these precautions before installing or running it: - Secrets: It needs your OPENAI_API_KEY. It also expects a 1Password service token (OP_SERVICE_ACCOUNT_TOKEN) / or a token file at ~/.config/openclaw/.op-service-token to run the 'op' CLI and fetch the OpenAI key. Providing a 1Password service token gives the script the ability to read stored secrets—only proceed if you trust the code and the exact 1Password item path (op://OpenClaw/OpenAI API Key/credential). - Binaries and deps: The script calls the 'op' CLI but the skill metadata does not list 'op' as a required binary. Ensure 'op' is installed and reviewed before use. You will also need to install Python packages (requests, mflux, diffusers, torch, etc.) and expect large model downloads from HuggingFace (>7GB). Run in an environment with sufficient disk space and network policy you control. - File writes: The script will save images and runs.json into workspace/content/images and—if a Proton Drive path exists—into a hardcoded Proton Drive directory. If you do not want artifacts copied to cloud‑synced folders, check or remove that hardcoded path in the script first. - Audit before running: Because the script invokes subprocesses and accesses local credential stores, review the code yourself (or run it in an isolated VM/container) to confirm it only accesses the locations you expect. Consider setting OPENAI_API_KEY directly instead of giving the script access to your 1Password service account, or remove the 1Password fetch logic if you prefer. If you are comfortable with those behaviors (network outbound, large downloads, local file writes, and optional 1Password access), the skill is coherent enough for use; if not, treat it as untrusted and do not provide sensitive tokens or run it on a production machine.

Type: OpenClaw Skill Name: image-gen-compare Version: 1.0.1 The skill facilitates image generation comparison but includes high-risk behaviors such as executing subprocesses and accessing sensitive files in the user's home directory. Specifically, `scripts/image_gen_compare.py` reads a service token from `~/.config/openclaw/.op-service-token` and uses `subprocess.run` to invoke the 1Password CLI (`op`) for secret retrieval. While these actions are documented in the `SKILL.md` security notes and aligned with the stated purpose of API key management, the use of out-of-band secret retrieval and hardcoded local cloud storage paths (Proton Drive) meets the threshold for a suspicious classification.