Skywork Design (skywork) - Generate or edit images via the Skywork Image API. Use for image creation, poster design, logo design, visual asset generation, or...
Security Analysis
high confidenceThe skill's code, runtime instructions, and requested environment variable align with its stated purpose (image generation/editing via Skywork); nothing requests unrelated credentials or performs unexpected actions.
Name/description match the code and SKILL.md: the scripts call a Skywork image gateway and require SKYWORK_API_KEY and python3 — all expected for an image API client.
Runtime instructions are narrowly scoped to preparing prompts, checking input image files, calling the Skywork API, and saving/downloading the returned image. The SKILL.md also contains UX rules (error handling, language for upgrade messages) that require the agent to parse server messages (e.g., extract an upgrade URL from a log). This is specific but consistent with the skill's purpose; it does give the agent discretion to surface links extracted from server responses.
No install spec — instruction-only plus small Python scripts. No external downloads or package installs are performed by the skill.
Only SKYWORK_API_KEY is required (declared as primaryEnv). The code reads only that env var and does not access other credentials or system config paths.
always is false and the skill does not modify other skills or system settings. It only reads SKYWORK_API_KEY at runtime; no elevated or persistent privileges are requested.
Guidance
This skill appears to do exactly what it says: it encodes local images and prompts, sends them to Skywork's API at https://api-tools.skywork.ai/theme-gateway, and downloads the returned image. Before installing, verify you trust the Skywork service and the API key you provide (SKYWORK_API_KEY). Note that the key will be stored/managed by your OpenClaw/Claude Code configuration per the provided instructions (e.g., ~/.openclaw/openclaw.json or shell/env settings) — ensure you are comfortable storing the key there and that the key's scope/quota is appropriate. Also be aware that any prompts and images you submit will be transmitted to the remote API. If you need stronger assurances, review Skywork's privacy/security docs and consider using a limited-scope API key or test account.
Latest Release
v1.0.8
skywork-design v1.0.8 - Updated API key configuration instructions for clarity. - Minor wording and formatting improvements throughout the documentation. - No functional or workflow changes; usage and capabilities remain the same.
More by @gxcun17
Published by @gxcun17 on ClawHub
