Vidu AI 图片生成。支持 Nano 生图、Vidu 参考生图。对话式调用，自动识别意图。
Security Analysis
high confidenceThe skill claims to be an image-generation helper but its shipped code asks for an API key that the registry metadata omitted and implements many extra capabilities (video, TTS, voice cloning) and local-file upload behavior that the SKILL.md does not fully disclose.
The skill name/description and SKILL.md focus on image generation, but the included CLI (scripts/vidu_cli.py) implements many additional capabilities: video endpoints (text2video, img2video, reference2video, etc.), audio/TTS and voice-clone endpoints. Those extra capabilities are not documented in the SKILL.md summary or registry metadata, which makes the overall purpose and required privileges unclear.
SKILL.md instructs the agent to call the provided Python CLI for image-generation and status checks and documents image-specific behavior. The CLI, however, can read local files (converting images to base64), fetch remote URLs, and supports additional commands (video/audio) not documented in SKILL.md. This gives the agent the ability to upload arbitrary local files and call endpoints beyond the documented scope if invoked.
No install spec is present; the skill is instruction + a bundled Python script. No external downloads or installers are used, so nothing is automatically written to disk beyond the packaged files. This is the lower-risk install pattern.
Registry metadata declared no required environment variables, but SKILL.md and the CLI both require VIDU_API_KEY. The skill will read VIDU_API_KEY from environment and will fail without it. Requesting a single API key is reasonable for an external service, but the registry omission is an inconsistency that could confuse users and automated permission checks. Also note: the CLI will include local image data (base64) in API requests — supplying local files causes data to be transmitted to the remote API.
The skill does not request 'always: true' and does not declare modifications to other skills or global agent configuration. Autonomous invocation is allowed (platform default) but not combined with other elevated privileges here.
Guidance
Before installing, consider the following: - The registry metadata omitted required env vars: this skill requires VIDU_API_KEY (the SKILL.md and code both check for it). Confirm you trust the VIDU API provider before supplying a key. - The shipped Python CLI supports video and audio endpoints (text2video, TTS, voice clone) in addition to image generation. If you only want simple image generation, be cautious: the agent could be instructed to use the extra endpoints or to upload other local files. - Using local images means the script will read files, base64-encode them, and send them to the remote API — do not supply sensitive images you don't want transmitted. - There is no declared homepage or official source; prefer skills with an identified upstream repo or vendor. If you plan to use this skill, review the full scripts/vidu_cli.py file (and the API endpoints) yourself or only provide an API key with limited scope/permissions. - If anything about the domain selection, endpoints, or required behaviors is unclear, ask the publisher for an authoritative homepage, documentation, or a signed release before trusting API credentials.
Latest Release
v1.0.0
- Initial release of vidu-image-generate skill for Vidu AI image generation. - Supports both text-to-image and reference-image modes, with automatic intent recognition from user prompts. - Integrates multiple Vidu Nano and Vidu reference image models, with automated model and API domain selection based on user language. - Provides user-friendly output in Markdown with downloadable image links, generated via secure API key. - Includes detailed guidelines on usage, environment variables, supported modes, and error handling.
Popular Skills
Published by @x-jihua on ClawHub
