wan-image-gen

Generate images using Alibaba DashScope wan2.6-t2i model, download to Desktop, and upload to catbox.moe image hosting. Use when the user asks to generate, cr...

This skill appears to do what it says (call Alibaba DashScope to generate images and upload them to catbox.moe) but there are a few things to check before installing: 1) The SKILL.md requires DASHSCOPE_API_KEY but the registry metadata lists no required env vars — ask the publisher to correct the metadata so you know beforehand what secret will be used. 2) SKILL.md contains a literal-looking API key in an example; do not assume it is safe. Treat it as a possible leaked secret and ask the maintainer to remove or redact it. 3) The workflow writes images to your Desktop and uploads them to a public third-party host (catbox.moe). Confirm you are comfortable with generated images being stored publicly and that no sensitive content will be uploaded. 4) Verify the DashScope endpoint (dashscope-intl.aliyuncs.com) is the correct official API and use a scoped or disposable API key for initial testing. 5) Consider updating the skill to prompt the user explicitly before writing files or uploading, and to avoid embedding credentials in docs. If the publisher clarifies the env var requirement and removes the hardcoded example key, the inconsistencies would be resolved.

Type: OpenClaw Skill Name: wan Version: 1.0.0 The skill is classified as suspicious due to several risky capabilities, even though its stated purpose (image generation, download, upload) appears benign. The `SKILL.md` instructs the AI agent to handle a sensitive `DASHSCOPE_API_KEY` by 'asking the user', which creates a direct prompt injection surface for an attacker to potentially extract the key from the agent. Additionally, the skill directly executes powerful shell commands like `curl` for network operations and `python3 -c` for JSON parsing, which, while used benignly here, represent significant execution capabilities that could be exploited if user input were ever mishandled. Finally, the skill uploads content to `catbox.moe`, an external, untrusted image hosting service, adding an external dependency.