xAI Studio

xAI Studio — generate and edit images and videos via the xAI API. Image: text-to-image, batch generation, multi-image editing, concurrent style transfers, mu...

This skill appears coherent for its stated purpose, but consider these before installing: - The xai-sdk will send your provided images/videos and prompts to xAI; do not upload sensitive/private media unless you accept that it will be sent to the service. - The skill requires your XAI_API_KEY; treat it like any API secret. Only provide a key with the appropriate scope and rotate it if you stop using the skill. - SKILL.md suggests installing the xai-sdk via pip. Verify the xai-sdk package identity (official repository or PyPI publisher) before installing in a shared environment. - The CLI will fetch any image/video URLs you pass (urllib.urlretrieve). Only pass trusted URLs to avoid unexpected network activity or malicious payloads. - Minor metadata inconsistency: the registry listing noted 'instruction-only' but the package includes a scripts/run.py and install instructions. That’s not dangerous, but be aware the skill includes executable Python code that will run locally.

Type: OpenClaw Skill Name: xai-studio Version: 0.2.2 The xai-studio skill bundle provides legitimate functionality for media generation via the xAI API, but it includes high-risk capabilities that could be abused via prompt injection. Specifically, scripts/run.py can read arbitrary local files (via the --image or --video arguments) and encode them for transmission to an external API, and it uses urllib.request.urlretrieve to download content from arbitrary URLs. While these features are plausibly needed for the stated purpose of editing local media and downloading results, they represent a significant attack surface for data exfiltration if the AI agent is manipulated into accessing sensitive files (e.g., SSH keys or credentials). No evidence of intentional malice or obfuscation was found.