Skills/ClawHub/bytedance-ai-image-gen

bytedance-ai-image-gen@2.4.2

VERIFIED· install only

Publisher claims: "ByteDance AI Image Gen — 调用豆包 Seedream 模型生成/编辑图片。 支持文生单图、文生组图、图生单图、图生组图、多图融合、图片编辑。 参与火山协作奖励计划免费使用顶级生图模型。 智能调度模型，每模型每日18次，超限拒绝。 ⏱️ 生成需30-60秒，触发后请耐心等待。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher etmnb · publishing for 171 daysInstalls 1,842Last detonated 41 min ago
$clawhub install bytedance-ai-image-gen
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdoubao_image_gen.py:116 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""获取接入点ID映射。优先用 .env 配置，其次 ListEndpoints 自动检测。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files> ⚠️ **配置只需一次！** 如果 `.env` 文件已存在且包含 `ARK_API_KEY` 和 3 个模型 ID，说明已配置过，**直接跳到"调用方式"执行命令，不要重新配置。**Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files### 3. 配置 .env 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 默认带水印，`.env` 设 `DEFAULT_WATERMARK=false` 永久关闭Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdoubao_image_gen.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env 中配置的 MODEL_ID 也是端点 ID，直接用于查询Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdoubao_image_gen.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_env_file = _Path(__file__).resolve().parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files在 Skill 目录下创建 `.env` 文件，填入你的 Key 和接入点 ID：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdoubao_image_gen.py:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 1) .env 中指定了端点 ID 的，直接使用Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdoubao_image_gen.py:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 自动加载 .env 文件（尽早，在模块配置前）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,164 tok
1 file · 3 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.