上传一张产品白底图，AI 自动生成电商全套素材：商品主图、场景图、卖点海报、营销文案与 8 秒展示视频。Generate full ecommerce assets from a single product photo.

This skill appears to do what it says (generate images, posters, copy, and short videos) and needs network access to your configured AI Product Space server plus permission to read any local image file you choose to upload. Before installing: - Understand where images will be sent: by default the skill's docs point to https://renshevy.com; confirm the APS_BASE_URL you configure is a trusted endpoint. Uploaded images and prompts are transmitted to that service. - OAuth: the plugin defines an OAuth flow with very broad scopes ("*") in the manifest. Confirm the authorization screen and scopes when the browser opens; only proceed if you trust the service. - Configuration mismatch: the documentation and SKILL.md say to set APS_BASE_URL and APS_API_KEY in config.json, but the runtime code looks for context.config.baseUrl and context.config.apiKey (and falls back to process.env.APS_BASE_URL). This is likely a bug — OAuth may work if OpenClaw injects the configured APS_BASE_URL into the plugin, but manual API-key setups may fail unless you set environment variables or the differently named config keys. If you plan offline/manual usage, be prepared to set environment variables APS_BASE_URL and/or provide values under the names the runtime expects (baseUrl / apiKey), or contact the author/maintainer. - Test with non-sensitive images first. Because the skill uploads images to a remote service, avoid uploading private or proprietary photos until you verify the provider's privacy policy and that the endpoints are correct. - Verify source/trust: the package lists a homepage/repository (renshevy.com / github.com/renshevy/ai-product-space). If you require higher assurance, inspect the upstream repository, confirm the maintainer identity, or run the skill in an isolated environment. Given the implementation/config mismatches and broad OAuth scopes, treat the skill as suspicious until you verify endpoints and test the auth flow. If you can share logs or how OpenClaw populates context.config after OAuth (or a corrected config mapping), the assessment could be upgraded.

Type: OpenClaw Skill Name: ai-product-space Version: 1.0.4 The skill bundle is a legitimate integration for the AI Product Space platform, designed to generate ecommerce assets like images and videos. It uses network permissions to communicate with the service API (renshevy.com) and filesystem permissions to read local image files for uploading, both of which are justified by the tool's stated purpose. The code in 'dist/lib/api-client.js' and 'dist/tools/upload-image.js' follows standard patterns for file handling and API interaction without any evidence of obfuscation, data exfiltration, or malicious intent.