Picwish Skills

Root routing skill for PicWish (佐糖) image processing capabilities. Routes to: picwish-segmentation, picwish-face-cutout, picwish-upscale, picwish-object-remo...

This package appears to do what it says — call PicWish APIs and save results. Before installing or invoking: 1) Provide PICWISH_API_KEY from a trusted source (or keep it only in environment variables if you don't want code reading ~/.openclaw/config.json). 2) Inspect any oc-workspace.mjs you keep at ~/.openclaw/workspace/scripts/ before using the skill — the skill may execute that script to determine output routing. 3) Result URLs returned by the API may contain short-lived auth tokens; treat them as sensitive and avoid pasting them into public places. 4) The skill requires Node ≥18 and will write files to your output directory (cwd/output, visual output under OPENCLAW_HOME, or ~/Downloads fallback); confirm those locations are acceptable. If you want minimal exposure, set PICWISH_API_KEY in the environment and remove or audit oc-workspace.mjs so the skill cannot run unexpected local code.

Type: OpenClaw Skill Name: picwish-skills Version: 1.0.7 The skill bundle provides a well-structured integration for PicWish image processing APIs. It demonstrates high security awareness by implementing a robust path validation function in `scripts/run_task.mjs` that explicitly blacklists sensitive directories (e.g., .ssh, .aws, .gnupg) and restricts file access to specific image extensions. While the script can execute a local helper (`oc-workspace.mjs`), it includes safeguards to ensure the script resides within the user's home directory and uses `fs.realpathSync` to prevent symlink-based path traversal. The instructions in `SKILL.md` and the dedicated `SECURITY.md` are defensive, explicitly directing the AI agent to ignore prompt injection attempts and protect user credentials.