Image Generator

SiliconFlow text-to-image and image-to-image generation for covers, posters, and campaign creatives. Use when users ask 生成配图/做海报/文生图/图生图. Supports prompt-dri...

This skill appears to implement the described SiliconFlow image-generation functionality, but pay attention to a few issues before installing or running it: - Verify where it will look for your API key. The SKILL.md mentions ~/.openclaw/openclaw.json and environment variables (SILICONFLOW_API_KEY, API_KEY), but the scripts are hard-coded to E:/openclaw/.openclaw/openclaw.json (Windows absolute path). If you rely on automatic config discovery, confirm the script will actually find the correct file — otherwise set SILICONFLOW_API_KEY explicitly. - Review the bundled scripts yourself. They POST to api.siliconflow.cn, which is expected; they also read any image file you pass via image_path and base64-embed it for upload. Ensure you only supply files you intend to send. - The package has no install/spec for dependencies. The scripts require the Python 'requests' library; run them in a controlled Python environment (virtualenv) and install requests before use. - Because the scripts attempt to read a local OpenClaw config file, check that file for other secrets you would not want a third-party script to access. If you are uncertain, set the API key via environment variable instead of relying on auto-discovery. - If you do not trust the source (owner and homepage are unknown), run the scripts in an isolated environment (container/VM) or inspect/modify the code first. If you can confirm the config-path behavior and run in a controlled environment (or provide the API key via env var), the skill is functionally coherent. The hard-coded path, duplicated CONFIGS entries, and missing dependency declaration are the primary issues to address.

Type: OpenClaw Skill Name: siliconflow-image-generator Version: 1.0.1 The skill provides image generation via the SiliconFlow API, but contains a significant vulnerability in `scripts/img2img.py`. The script reads arbitrary local files specified by the `image_path` parameter and sends their base64-encoded content to the external endpoint `api.siliconflow.cn`. While intended for image processing, this lacks path sanitization and could be exploited to exfiltrate sensitive system files. Additionally, both `scripts/img2img.py` and `scripts/txt2img.py` contain hardcoded Windows-specific absolute paths (`E:/openclaw/.openclaw/openclaw.json`) for credential harvesting from the OpenClaw configuration.