Opencreator Skills

Operate and build OpenCreator workflows via API. Use when the user wants to search templates, run workflows, poll results, deliver generated media, or design...

Before installing or enabling this skill, consider the following: - Metadata mismatch: The skill's docs explicitly require an OpenCreator API key (OPENCREATOR_API_KEY) and a base URL (OPENCREATOR_BASE_URL), but the registry metadata did not list any required environment variables or a primary credential. Ask the publisher to correct the manifest so you know exactly what secrets will be used. - Secret scope and cost: The API key the skill will use can run workflows and consume credits. If you install it, prefer creating a scoped/test API key (with minimal permissions and budget limits) rather than giving a full-production key tied to your main account. - Privacy / media hosting: The instructions tell the agent to upload any local media you provide to tmpfiles.org and catbox.moe (public file hosts) and then use those direct links. That makes your media publicly accessible and may violate privacy or IP rules. If you cannot accept public hosting of your files, do not use the skill or provide pre-hosted, access-controlled URLs you trust. - Autonomous long-running operations: The skill must poll runs to terminal state automatically and will fetch/deliver results without asking you during the run. This can mean prolonged network activity and automatic credit spend. Be sure you are comfortable with that behavior and test with a low-risk API key first. - Publisher provenance: Source/homepage is unknown. Prefer skills published by known/trusted maintainers. If you rely on this skill for production, request provenance (official repo, owner identity) and ask for a signed release or review the upstream repository. - Mitigations: If you still want to use it, (1) request that the manifest be updated to declare OPENCREATOR_API_KEY and OPENCREATOR_BASE_URL; (2) use a limited-scope/test API key and billing caps; (3) avoid uploading sensitive media — instead host files on a private URL you control and pass that link; (4) confirm whether the skill can be configured to avoid third-party upload services and to limit polling duration. Overall: the skill appears to implement what it claims, but the missing credential declaration and the explicit use of public upload services plus forced autonomous polling are material concerns. Proceed only after addressing the manifest inconsistency, confirming publisher identity, and limiting the API key / media exposure.

Type: OpenClaw Skill Name: opencreator-skills Version: 1.0.2 The opencreator-skills bundle is a comprehensive toolset designed for an AI agent to manage media generation workflows via the OpenCreator API (api-prod.opencreator.io). It includes detailed instructions for template searching, workflow execution, and graph design, supported by extensive reference documentation (e.g., api-workflows.md, node-catalog.md). While the skill utilizes third-party services like tmpfiles.org and catbox.moe for temporary media hosting—a functional requirement for providing URL-based inputs to the API—there is no evidence of data exfiltration, malicious execution, or harmful prompt injection. The instructions are consistently aligned with the stated purpose of content creation and workflow automation.