首页 › 龙虾技能列表 › tl-aliyun-image-generator — 技能工具

🎓 tl-aliyun-image-generator — 技能工具

v1.0.0

【专属触发指令：千问画个图】调用阿里云通义万相生成高质量图片。仅当用户的指令以“千问画个图”开头时，才允许路由到此技能。

0· 84·0 当前·0 累计
by @roykingw (wangliangyi)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/3/31
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
medium confidence
The skill mostly does what it says (generate images via Aliyun) but its runtime instructions and code ask users to paste sensitive API keys into chat and then save them unencrypted locally, which is disproportionate and risky.
评估建议
This skill appears to perform Aliyun image generation as described, but it instructs the agent to ask users to paste their Aliyun API Key into the chat and the bundled script saves that key in plaintext to a local file (.aliyun_key). Before installing or using it, consider: 1) Do not paste production or high-privilege API keys into chat — create a scoped/test key for this purpose that you can revoke. 2) Review the script code (already included) and be aware it will auto-install Python packages v...
详细分析 ▾
✓ 用途与能力
Name/description match the included code and instructions: the skill runs a local Python script that calls an Aliyun text-to-image endpoint. No unrelated binaries or cloud credentials are requested up front.
⚠ 指令范围
SKILL.md explicitly instructs the agent to prompt users to paste their Aliyun API Key into the chat (plaintext) when the script prints [NEED_KEY]. That grants the skill broad ability to solicit sensitive secrets from users and does not suggest a secure input mechanism. It also tells the agent to run a local script and report a local file path back to the user — acceptable for the purpose, but combined with secret solicitation this expands risk.
ℹ 安装机制
There is no installer spec, but the included script will auto-install the 'requests' package at runtime by invoking pip (subprocess). Runtime pip installs are common but carry risk (network fetching, arbitrary code execution during install) and the script does not pin versions or validate the environment.
⚠ 凭证需求
The skill requests the user's Aliyun API Key by instructing the agent to ask users to paste keys (sk-...). The script then saves the key unencrypted to a local file (.aliyun_key) in the skill directory. Asking for and persisting a plaintext secret via chat is disproportionate given safer alternatives (secure secret input, environment variables, or encrypted storage).
ℹ 持久化与权限
The script persists the API Key permanently to a local hidden file in the skill folder and will delete it if the key is rejected. It does not request 'always: true' nor modify other skills, but permanent local storage of secrets is a persistence behavior users should be aware of.
安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.02026/3/31

Initial release of aliyun-image-generator skill. - Generates high-quality images via Aliyun Tongyi Wanxiang, triggered only when input starts with "千问画个图". - Strict trigger condition: Skill activates only for prompts beginning with "千问画个图". - Expands user prompts into detailed image descriptions (50–100 words). - Handles API Key requirements: Requests and stores user's Aliyun API Key if not configured. - After generation, returns the local file path of the generated image to the user.

● 可疑

安装命令 点击复制

官方npx clawhub@latest install aliyun-image-generator
镜像加速npx clawhub@latest install aliyun-image-generator --registry https://cn.clawhub-mirror.com

技能文档

🚨 严格触发条件： 你必须且只能在用户的输入明确包含或以 “千问画个图：” 或 “千问画个图” 开头时，才触发并使用本技能。 如果用户只是说“画个图”或“生成图片”而没有带上“千问”字眼，请勿使用本技能（请使用你系统默认的画图工具）。

工作流程

  • 创意扩写：将用户的简短提示扩写为 50-100 字的详细画面描述。
  • 执行生成：调用本地 Python 脚本。

命令格式

默认调用格式（如果已经配置过 Key）： 

python3 scripts/generate_image.py "你扩写后的详细画面描述"

【重要：API Key 处理逻辑】 如果你执行上述命令后，终端返回 [NEED_KEY] 的错误信息，说明本地尚未配置阿里云 API Key。 此时，你必须：

中断画图任务，在聊天中礼貌地回复：“我需要您的阿里云百炼 API Key 才能使用通义万相为您画图。请直接将 Key 发送给我（以 sk- 开头）。” 当用户回复了 API Key 后，使用带 Key 的命令重新执行：

python3 scripts/generate_image.py "你扩写后的详细画面描述" "sk-xxxxxxxxxxxx"
(注：Python 脚本接收到后会自动将其永久保存到本地，下次就不需要再传了)

结果反馈

脚本执行完成后，会输出图片的本地保存路径（如 downloads/generated_img_xxx.png）。 请直接将这个文件路径和名称告诉用户。

数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制

了解定制服务