SiliconFlow 多模态服务，支持图片生成(FLUX/Qwen)、视频生成(Wan)、TTS语音合成、ASR语音识别。使用代金券支付。

SiliconFlow 多模态服务，支持图片生成(FLUX/Qwen)、视频生成(Wan)、TTS语音合成、ASR语音识别。使用代金券支付。

This skill is internally consistent, but before installing: (1) confirm you trust the siliconflow.cn service and the API key you provide (the key gives the service access to use your voucher balance and process uploaded files); (2) be aware that any audio/images you pass will be uploaded to SiliconFlow servers; (3) ensure your runtime has the dependencies (requests, pillow) installed; and (4) if you need stricter privacy, avoid sending sensitive audio/images or use a vetted/private model provider instead.

Type: OpenClaw Skill Name: siliconflow-media Version: 1.0.0 The skill bundle exhibits several vulnerabilities related to file path handling. The `scripts/asr.py` and `scripts/video_gen.py` scripts read user-specified input files (`--audio`, `--image`) and send their content to an external API (`api.siliconflow.cn`). This creates an arbitrary file read vulnerability, potentially leading to data exfiltration if an attacker can prompt the agent to read sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). Additionally, `scripts/image_gen.py`, `scripts/tts.py`, and `scripts/video_gen.py` write to user-specified output files (`--filename`). This creates an arbitrary file write vulnerability, potentially leading to persistence or privilege escalation (e.g., writing to `/etc/cron.d/malicious_job`) if the agent is prompted to write to sensitive system paths. These vulnerabilities stem from a lack of input sanitization for file paths, making the skill susceptible to prompt injection attacks against the agent, despite the scripts themselves not exhibiting malicious intent.