← 返回 Skills 市场
Re Blog Image
作者
Dishant Sharma
· GitHub ↗
· v1.1.2
· MIT-0
139
总下载
0
收藏
0
当前安装
6
版本数
在 OpenClaw 中安装
/install re-blog-image
功能描述
Generate a 1600px-wide webp blog thumbnail image using the nano-img CLI. Use when the user provides a blog topic or blog name and wants a thumbnail image gen...
安全使用建议
Before installing or running this skill: (1) Ask the author/maintainer to update the skill metadata to declare NANO_IMAGE_API_KEY and the ~/blog-meta path(s). (2) Verify why the skill insists on sourcing ~/.zshrc and echoing the API key — this can expose secrets; prefer a documented, explicit credential configuration. (3) Back up ~/blog-meta before first run; the skill will modify JSON files and requires write access. (4) Inspect the nano-img-cli skill (and any npm package it installs, e.g., nanobana) to ensure they are trusted. (5) Resolve the contradictory guidance in SKILL.md vs references (one says never ask user to set the key; the other suggests exporting it). If the maintainer cannot clarify these inconsistencies and justify the secret access/update behavior, treat the skill as high-risk and avoid installing it.
功能分析
Type: OpenClaw Skill
Name: re-blog-image
Version: 1.1.2
The skill exhibits high-privilege behaviors, specifically requiring the agent to source the user's shell configuration file (`~/.zshrc`) to retrieve API keys and performing global npm installations (`npm install -g nanobana`). Sourcing shell configurations is a risky practice as it executes arbitrary code present in the user's environment. While these actions are aligned with the stated purpose of generating blog images via the `nano-img` CLI, the combination of environment execution and mandatory global package installation presents a significant security surface without explicit user consent for each step. These instructions are primarily located in SKILL.md.
能力标签
能力评估
Purpose & Capability
The declared metadata lists no required env vars, credentials, or config paths, yet the SKILL.md explicitly depends on an API key (NANO_IMAGE_API_KEY), a separate nano-img-cli skill, creates ~/blog-images, and updates ~/blog-meta/*.json. The skill should have declared the API key and the config paths it will touch; their absence is an incoherence.
Instruction Scope
The instructions tell the agent to echo and source ~/.zshrc to obtain NANO_IMAGE_API_KEY (accessing a user dotfile and revealing a secret), and to search/modify ~/blog-meta/*.json files. There are also direct contradictions: SKILL.md says 'never ask the user to add or set the API key manually' while references say to ask the user to export the key. These broaden the agent's file/secret access beyond what the metadata claims.
Install Mechanism
This is instruction-only (no install spec), which is lower surface-risk, but it instructs running `npm install -g nanobana` if nano-img is missing and to `openclaw skills install nano-img-cli`. Global npm installs and third-party skill installs are expected for this task but carry the usual risks of executing code from npm or an unvetted skill. No obscure download URLs are used.
Credentials
The skill requires access to NANO_IMAGE_API_KEY (a sensitive secret) but the registry metadata lists no required env vars or primary credential. Additionally, the SKILL.md instructs sourcing ~/.zshrc and echoing the key (which may expose the secret in logs). This is disproportionate and undocumented in the metadata. The contradictory guidance about asking the user to set the key adds to the concern.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. However, it mandates creating ~/blog-images and writing to ~/blog-meta/*.json — persistent modifications to the user's home. Writing/updating arbitrary JSON files without the metadata declaring config paths is a notable privilege but not an automatic blocker; it should be documented and consented to.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install re-blog-image - 安装完成后，直接呼叫该 Skill 的名称或使用
/re-blog-image触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.1.2
No code or documentation changes detected in this version.
- Version 1.1.2 contains no updates; all files remain unchanged.
v1.1.1
## re-blog-image 1.1.1 Changelog
- No changes detected from the previous version.
- Documentation and skill behavior remain unchanged.
v1.1.0
No user-facing or functional changes in this version.
- No file changes or SKILL.md updates detected.
- Behavior, interface, and documentation remain unchanged.
v1.0.9
- Added a new prerequisite check: now requires that the NANO_IMAGE_API_KEY environment variable is set, and sources ~/.zshrc if it is not already available.
- Improved instructions to ensure the API key check is never skipped, and to avoid prompting the user to set the key manually.
- No changes to the core image generation workflow or other quality bar requirements.
v1.0.8
- Changed install command in docs from openclaw skill install nano-img-cli to openclaw skills install nano-img-cli.
- No other functional or workflow changes. Documentation only.
v1.0.7
- Documentation and instructions fully rewritten with strict, step-by-step workflow for generating 1600px-wide webp blog thumbnails using nano-img CLI.
- Emphasizes critical, non-negotiable requirements for dependencies, command flags, prompt text, and output paths.
- Details mandatory checks for nano-img availability, including install procedures and error reporting.
- Outlines the process to update matching blog-meta JSON files with the generated thumbnail path after creation.
- Defines a clear completion report format covering: topic used, command run, output file path, file existence, and metadata updates.
元数据
常见问题
Re Blog Image 是什么？
Generate a 1600px-wide webp blog thumbnail image using the nano-img CLI. Use when the user provides a blog topic or blog name and wants a thumbnail image gen... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 139 次。
如何安装 Re Blog Image？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install re-blog-image」即可一键安装，无需额外配置。
Re Blog Image 是免费的吗？
是的，Re Blog Image 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Re Blog Image 支持哪些平台？
Re Blog Image 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Re Blog Image？
由 Dishant Sharma（@dishant0406）开发并维护，当前版本 v1.1.2。
推荐 Skills