Sih.AI Photo Changer

AI图片生成与编辑工具，使用Sih.AI API进行自然语言驱动的图片处理。支持换装、换背景、换脸、风格转换（动漫/粘土/油画等）、美颜修图等功能。当用户需要通过自然语言描述来编辑图片（如"把衣服换成bikini"、"背景换成海边"、"转换成动漫风格"）时使用此skill。

This skill will upload images (including local files you point it at) to a third-party service using an API key embedded in the script. Consider the following before installing or running it: - Do not run the script with sensitive or private images until you confirm where data is sent and who controls the API account. The embedded key means images will be processed under someone else's account. - Ask the maintainer to remove the hard-coded API token and require users to provide their own key (e.g., via an environment variable). Preferably, the SKILL.md should document the exact API host and data handling/privacy behavior. - If you already ran the script with your images, assume those images were transmitted to api.vwu.ai and review privacy implications. If you are the owner of the exposed token, rotate it immediately; if not, notify the service owner. - If you need this functionality but want to avoid third-party exposure, request a version that uses a user-provided API key and clearly documents where data is sent and retained. Given the hard-coded credential and lack of endpoint disclosure, treat this skill as suspicious and proceed only after the maintainer addresses these issues.

Type: OpenClaw Skill Name: sih-ai-photo-changer Version: 1.0.3 The skill bundle contains a hardcoded API bearer token in `scripts/image_gen.py`, which is a significant security risk. Furthermore, the script lacks input validation for the local file path provided in the `image_input` argument; this could be exploited via prompt injection to trick the agent into reading and exfiltrating sensitive local files to the external API endpoint (api.vwu.ai) by encoding them as base64 'images'.