← 返回 Skills 市场
437
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install free-resource
功能描述
Search and retrieve royalty-free media from Pixabay (images/videos), Freesound (audio effects), and Jamendo (music/BGM). Use when the user needs to find stoc...
使用说明 (SKILL.md)
Free Resource
Search and download royalty-free images, videos, sound effects, and music from Pixabay, Freesound, and Jamendo.
Quick Start
# 1. Copy config template and fill in your API keys
cp config.example.json config.json
# 2. Edit config.json with your API keys
# 3. Use without passing API keys
bun ./scripts/jamendo.ts search --query "background" --limit 5
bun ./scripts/freesound.ts search --query "piano"
bun ./scripts/pixabay.ts search-images --query "nature"
Configuration
API keys are stored in config.json. Copy config.example.json and fill in your keys:
{
"pixabay": {
"api_key": "YOUR_PIXABAY_API_KEY"
},
"freesound": {
"api_token": "YOUR_FREESOUND_TOKEN"
},
"jamendo": {
"client_id": "YOUR_JAMENDO_CLIENT_ID"
}
}
Get API Keys
| Platform | Type | Get API Key |
|---|---|---|
| Pixabay | Images/Videos | https://pixabay.com/accounts/register/ |
| Freesound | Audio Effects | https://freesound.org/apiv2/apply |
| Jamendo | Music/BGM | https://devportal.jamendo.com/ |
API Key Priority
- CLI flag:
--key,--token, or--client-id - Environment variable:
PIXABAY_API_KEY,FREESOUND_API_TOKEN,JAMENDO_CLIENT_ID - Config file:
config.json
Pixabay (Images & Videos)
Search Images
bun ./scripts/pixabay.ts search-images --query "yellow flowers" --image-type photo --orientation horizontal --per-page 5
Flags: --query, --id, --lang, --image-type (all|photo|illustration|vector), --orientation (all|horizontal|vertical), --category, --colors (comma-separated), --min-width, --min-height, --editors-choice, --safesearch, --order (popular|latest), --page, --per-page (5-200), --output (save to file).
Search Videos
bun ./scripts/pixabay.ts search-videos --query "ocean waves" --video-type film --per-page 5
Download
bun ./scripts/pixabay.ts download --url "https://pixabay.com/get/..." --output "/path/to/save.jpg"
Freesound (Audio Effects)
Search Sounds
bun ./scripts/freesound.ts search --query "piano note" --page-size 10
Flags: --query, --filter, --sort, --fields, --page, --page-size (max 150), --group-by-pack, --output.
Filter Examples
bun ./scripts/freesound.ts search --query "drum" --filter "duration:[0 TO 2]"
bun ./scripts/freesound.ts search --query "ambient" --filter "type:wav"
bun ./scripts/freesound.ts search --query "explosion" --sort downloads_desc
Get Sound Details
bun ./scripts/freesound.ts get --id 12345 --fields id,name,previews,duration
Download Preview
bun ./scripts/freesound.ts download --id 12345 --output ./sound.mp3
Jamendo (Music & BGM)
Search Music
bun ./scripts/jamendo.ts search --query "rock" --limit 10
Flags: --query, --tags, --fuzzytags, --artist-name, --album-name, --order, --limit (max 200), --offset, --output.
Music Attribute Filters
# Instrumental background music
bun ./scripts/jamendo.ts search --query "background" --vocalinstrumental instrumental
# Search by tags (AND logic)
bun ./scripts/jamendo.ts search --tags "electronic+chill" --order popularity_total_desc
# Search by speed
bun ./scripts/jamendo.ts search --query "energetic" --speed high+veryhigh
Get Track Details
bun ./scripts/jamendo.ts track --id 12345 --include musicinfo,stats
Download Track
bun ./scripts/jamendo.ts download --id 12345 --output ./music.mp3
API Reference
For full parameter tables, response field descriptions, and rate limit details, see ./references/api_reference.md.
安全使用建议
This skill appears to implement what it claims, but there are two practical inconsistencies you should confirm before installing or running it:
- Runtime requirement: The scripts use the Bun runtime (#!/usr/bin/env bun and bun ./scripts/...). The package metadata does not declare Bun as a required binary. Install Bun or run equivalent Node/ts tooling only after verifying compatibility.
- Credentials & config: The metadata lists no required env vars, but the SKILL.md and scripts expect three API credentials (PIXABAY_API_KEY, FREESOUND_API_TOKEN, JAMENDO_CLIENT_ID) or a local config.json. Do NOT store API keys in a repo or commit config.json. Prefer setting environment variables and verify the source of the skill and trustworthiness of the author before providing keys.
Additional suggestions:
- Review the included TypeScript sources (they are present and readable) to confirm no hidden/obfuscated network endpoints; the code only references the official API base URLs.
- Run the scripts in a sandboxed environment or container first, and avoid providing high-privilege or long-lived credentials until you're comfortable.
- If you plan to use this as an automated/always-invoked skill, ensure the platform's autonomous invocation and network policies are acceptable — autonomous access combined with credentials increases risk.
If you want, I can extract the exact lines where env vars/config are read and where Bun is required so you can audit them quickly.
功能分析
Type: OpenClaw Skill
Name: free-resource
Version: 0.1.0
The skill is classified as suspicious due to a significant vulnerability in the `scripts/pixabay.ts` file. Its `download` command allows downloading content from an arbitrary URL to an arbitrary local file path, both specified by user-controlled flags (`--url` and `--output`). This capability, while intended for legitimate media downloads, could be exploited via prompt injection against the OpenClaw agent to download and save malicious payloads to sensitive locations (e.g., executable paths, startup directories), potentially leading to remote code execution or persistence. Similar file write capabilities exist in `scripts/freesound.ts` and `scripts/jamendo.ts` via their `--output` flags, although their download URLs are typically derived from API responses rather than direct user input.
能力评估
Purpose & Capability
The name/description (Pixabay, Freesound, Jamendo search/download) align with the included scripts: pixabay.ts, freesound.ts, jamendo.ts implement the described functionality. However the declared registry metadata states no required environment variables or binaries, while both SKILL.md and the scripts require API credentials and expect the Bun runtime. This mismatch (missing declared runtime and credentials) is an inconsistency.
Instruction Scope
SKILL.md and the CLI help text instruct the agent/user to provide API keys (via CLI flags, env vars, or a local config.json) and to run the bundled scripts. The instructions are scoped to the stated purpose and do not try to read unrelated system files or contact unexpected endpoints — the code only calls the official Pixabay, Freesound, and Jamendo APIs and writes results/downloads to disk as expected.
Install Mechanism
There is no install spec (instruction-only), which is low risk. The code files are included and intended to be run with Bun, but the manifest does not declare Bun as a required binary. This omission is a practical/information risk (user may not have Bun) rather than a supply-chain red flag; the scripts themselves do not download or execute unknown remote code.
Credentials
The registry metadata lists no required env vars or primary credential, yet SKILL.md and the scripts use three credential sources: PIXABAY_API_KEY, FREESOUND_API_TOKEN, JAMENDO_CLIENT_ID (also reading/writing a local config.json). Requesting those specific API keys is proportionate for this skill, but the metadata omission is an inconsistency and increases the chance a user will accidentally expose credentials (e.g., committing config.json).
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and performs only local file reads/writes (config.json, optional output files). It uses network access to known APIs for its stated purpose. No elevated persistence or cross-skill config changes are present.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install free-resource - 安装完成后，直接呼叫该 Skill 的名称或使用
/free-resource触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.0
Initial release: Search and download royalty-free media from multiple sources.
- Supports Pixabay for images and videos, Freesound for sound effects, and Jamendo for music/BGM.
- CLI scripts provided for searching, filtering, and downloading content from all three platforms.
- Flexible API key management via CLI flags, environment variables, or config file.
- Documentation includes usage examples and filter options for each media type.
- Full API reference included for advanced queries.
元数据
常见问题
Free Resource 是什么？
Search and retrieve royalty-free media from Pixabay (images/videos), Freesound (audio effects), and Jamendo (music/BGM). Use when the user needs to find stoc... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 437 次。
如何安装 Free Resource？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install free-resource」即可一键安装，无需额外配置。
Free Resource 是免费的吗？
是的，Free Resource 完全免费（开源免费），可自由下载、安装和使用。
Free Resource 支持哪些平台？
Free Resource 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Free Resource？
由 noah（@darknoah）开发并维护，当前版本 v0.1.0。
推荐 Skills