uni-image

Unified multi-platform AI image generation. Supports Volcengine Seedream, Alibaba Qwen Image, and Google Gemini (Nano Banana). Switch between models with a d...

Do not install or run this skill yet. The package is missing the referenced JavaScript files and run-time declarations are inconsistent (it expects you to run node but 'node' is not declared and the code is not included). Before using: 1) Verify the source: visit the provided homepage repository and confirm the uni-image-proxy.js and uni-image-inject.js files exist and match the published package. 2) Inspect those scripts thoroughly to ensure they do not exfiltrate keys or send data to unexpected endpoints (check all network destinations and file writes). 3) Prefer setting provider keys as environment variables rather than pasting them into a UI you don't control; if the skill stores keys to ~/.openclaw-dev/uni-image-config.json, inspect that file's contents and access controls. 4) Confirm you trust the author and the code (or run it in a sandboxed environment) before supplying any API keys. If you can't inspect the missing code or the repo doesn't match, consider this package incomplete/untrustworthy.

Type: OpenClaw Skill Name: uni-image Version: 1.0.0 The skill is classified as suspicious because it describes a high-risk architecture involving a fetch interceptor and a local proxy server (port 18800) to handle sensitive API keys. It references non-existent or future-dated AI models (e.g., 'Gemini 3.1' and 'Nano Banana') and contains a future-dated timestamp in `_meta.json` (year 2026), which suggests deceptive intent. Furthermore, the `SKILL.md` instructions suggest executing a script located outside the skill's expected directory (`../../uni-image-proxy.js`), which is a potential path traversal risk.