Stock Images

Source free stock photos and placeholder images with direct URLs for Unsplash, Pexels, Pixabay, and Lorem Picsum.

This skill is coherent and lightweight: it only supplies ready-to-use image URL patterns and optional local preference saving. Before installing or using it, consider: (1) Network/privacy — fetching images from external hosts will reveal your IP and request headers to those hosts (normal for hotlinking). (2) Licensing — verify license/attribution for production use even though many services permit casual use. (3) Stability — direct source URLs (e.g., source.unsplash.com) may redirect or change; if you need consistency, cache the final image URL or use IDs. (4) If you need higher request volume, attribution, or guaranteed terms, prefer the official APIs (which require keys) rather than anonymous hotlinking. If these tradeoffs are acceptable, the skill is fine to install.

Type: OpenClaw Skill Name: stock-images Version: 1.0.0 The skill is classified as suspicious due to potential prompt injection vectors and the inclusion of `curl` command examples. The `SKILL.md` instructs the agent to 'read `setup.md` silently' on first use, which is a direct prompt injection surface, though the current content of `setup.md` is benign. Additionally, `providers.md` contains `curl` examples for API interaction (e.g., `curl -H "Authorization: YOUR_API_KEY" ...`), which, if executed by the agent without proper sandboxing or user confirmation, could lead to arbitrary command execution and external network calls beyond the skill's stated purpose. While there is no clear evidence of intentional malicious behavior like data exfiltration or persistence, these elements represent significant vulnerabilities in the agent's execution model.