volcengine-image-generate

Using volcengine image_generate.py script to generate image, need to provide clear and specific `prompt`.

This skill appears to be what it says (generate images), but there are inconsistencies you should resolve before using it: - Authentication: The script requires an API key (MODEL_IMAGE_API_KEY or ARK_API_KEY) but the skill metadata lists no required env vars. Do not provide credentials unless you confirm which key the skill actually uses. The SKILL.md mentions VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY fallback, but the code does not use them—ask the author or inspect the Ark SDK behavior. - Dependency: The script imports volcenginesdkarkruntime. The skill provides no install instructions. Ensure that package is from a trusted source (pip package name and origin) and install it in a sandbox before running. - Output and file writes: The documentation states the script returns a generated image URL, but the script downloads images and prints local file paths. It writes to IMAGE_DOWNLOAD_DIR (default: current directory). Run it in a safe directory and verify filenames/permissions to avoid accidental overwrites. - Next steps: Ask the maintainer to (a) declare required env vars in the registry metadata, (b) provide install steps for the SDK or vendor the runtime dependency, and (c) fix SKILL.md to accurately describe output and fallback authentication behavior. If you must run it now, inspect the Ark SDK package source (or vendor), set the API key in a throwaway/test account, and run in an isolated environment.

Type: OpenClaw Skill Name: volcengine-image-generate Version: 1.0.0 This skill is designed to generate images using the Volcengine API. The `SKILL.md` provides clear instructions and describes the use of environment variables (`MODEL_IMAGE_API_KEY`, `ARK_API_KEY`) for authentication, which is a standard practice. The `scripts/image_generate.py` script implements this functionality, reading API keys from environment variables, making API calls to Volcengine, and downloading the generated images to a local directory. There is no evidence of prompt injection against the agent, malicious execution, data exfiltration beyond the intended API interaction, or persistence mechanisms. All observed behaviors are aligned with the stated purpose of image generation.