vision-skill

Use this skill for computer vision tasks including image recognition (OCR, object detection) and image generation (text-to-image, image-to-image). Supports a...

Key points before installing: - Do NOT trust the registry metadata that says 'no env vars' — this skill requires your Tencent COS keys and a Doubao/Volcengine API key. Only provide those secrets if you intend the skill to upload images to your COS bucket and call the Doubao API. - Verify the API endpoint: the client uses https://ark.cn-beijing.volces.com/api/v3 which does not match the README link to console.volcengine.com; confirm this hostname is legitimate for your provider or replace it with an official endpoint from your Doubao/Volcengine account. - Use least-privilege credentials: create a COS bucket and keys scoped to that bucket (and consider using short-lived tokens if possible) rather than reusing broad permanent keys. - Inspect and run the code in an isolated environment first (e.g., throwaway VM or container). The scripts will write to a local .tasks directory and .tasks/worker.log, spawn background worker processes, and upload local files to COS — confirm that behavior is acceptable. - If you will expose sensitive images, set the COS bucket permissions appropriately (private by default) and review how temporary URLs are generated/used. - If anything (metadata mismatch, unusual base_url, or unexpected network endpoints) looks off, ask the publisher for clarification or consider alternative, better-audited tools.

Type: OpenClaw Skill Name: vision-skill Version: 1.0.0 The vision-skill bundle is a legitimate tool for integrating Doubao AI vision and image generation models with Tencent Cloud COS storage. It implements an asynchronous task architecture using a background worker (worker.py) and a local task tracking system (.tasks/ directory). The code follows standard practices for API integration, including environment variable configuration for secrets and retry logic for network calls. No evidence of malicious intent, data exfiltration, or unauthorized execution was found; the use of subprocess in vision_cli.py is limited to hardcoded process management and task execution.