Pixshop Creative API — Developer REST Endpoints

Pixshop 开发者 REST API — 图片生成/编辑、视频制作、提示词库、应用市场、社区 / Pixshop Developer REST API — image generation/editing, video, prompts, apps, community endpoints. Use when...

This skill is largely a documentation page for Pixshop's REST endpoints, but it demonstrates ways to obtain tokens (installing a CLI and reading ~/.pixshop-config.json) without declaring required credentials. Before installing or enabling it: - Verify the skill's source or official Pixshop docs (no homepage/source provided here). - Prefer providing an explicit PIXSHOP_TOKEN environment variable rather than letting the agent run shell commands or read ~/.pixshop-config.json. - If you do not want the agent to access local files or run commands, remove or restrict allowed-tools (Bash/Read) or disable autonomous invocation for this skill. - If you consider installing the 'pixshop' npm CLI, review that package and its maintainers first (npm install -g runs code). - Be cautious with the Supabase examples: they reference apikeys and auth endpoints — never expose service anon/secret keys unless you intend to. If you want a low-risk integration, ask the skill author to declare required env vars (token) and remove instructions that encourage reading local config files or installing third-party CLIs.

Type: OpenClaw Skill Name: pixshop-creative-api Version: 1.0.0 The skill bundle provides documentation for the Pixshop Creative API but requires high-risk capabilities that expand the agent's attack surface. Specifically, SKILL.md instructs the agent to use 'Bash' to install a global NPM package (npm install -g pixshop) and 'Read' to access a local configuration file (~/.pixshop-config.json) to retrieve an access token. While these actions are plausibly needed for the stated purpose of a developer tool, the reliance on shell execution and direct filesystem access to sensitive configuration data is classified as suspicious according to the provided security criteria.