Nvidia Sdxl

Generate high-resolution PNG images from detailed text prompts using the NVIDIA Stable Diffusion XL model with customizable style, lighting, and resolution.

This skill will call NVIDIA's API and save images locally, which matches its description — but it contains a hard-coded API key in index.py even though no credentials are declared. That is risky: the embedded key could be expired, overused, or abused by the publisher, and distributing a secret in the code is a security smell. Before installing or running: (1) Do not trust the embedded API key — remove it and require a user-supplied key via an environment variable or config. (2) Verify you are comfortable with requests to ai.api.nvidia.com and any billing implications on the NVIDIA account behind that key. (3) Ensure the runtime has Python and the 'requests' package, and create/validate the workspace directory (~/.openclaw/workspace). (4) If you control the account that provided the key, rotate the key immediately; if you do not control it, avoid using the embedded key and replace it with your own. (5) If you need higher assurance, request the publisher remove secrets from code, and/or run the skill in an isolated environment to limit any potential misuse.

Type: OpenClaw Skill Name: nvidia-sdxl Version: 1.0.2 The skill bundle contains a hardcoded NVIDIA API key in `index.py`, which is a significant security vulnerability and a potential privacy risk, as it allows the key owner to monitor the user's prompts and usage. Additionally, the `_meta.json` file contains an anomalous future-dated timestamp (2026). While the functional code for image generation aligns with the documentation in `SKILL.md`, hardcoding credentials and using anomalous metadata are high-risk indicators.