token-aware-image

Generate themed social/marketing image React components using design tokens. Produces TSX files that render to PNG. Use when the user asks to generate images...

This skill appears internally consistent with its goal of generating token-driven React image components, but before running it you should: 1) Review and approve the workspace changes — the script will create a .token-image/ directory and write files into your project. 2) Inspect the generated package.json and the external npm dependency @zane-chen/token-image (and any transitive dependencies) before running npm install; npm installs can run arbitrary install scripts. 3) Be aware SKILL.md asks you to run `npx playwright install chromium`, which downloads browser binaries. If you prefer, run init.sh and installs in an isolated/sandboxed environment (container, VM) or a throwaway branch. 4) If you provide a custom tokens.json path, the skill will read that file — only provide files you trust. 5) If you need a stricter review, check the contents of .token-image/src and node_modules after installation and consider pinning versions or using an audit tool (npm audit, vendor lockfile) before rendering.

Type: OpenClaw Skill Name: token-image Version: 1.0.0 The token-image skill bundle is a legitimate tool designed to generate themed marketing images by rendering React components using Playwright. The workflow defined in SKILL.md and the supporting prompts (writer.md, reviewer.md) correctly orchestrate a multi-agent process for content planning, component generation, and visual review. The initialization script (scripts/init.sh) safely bootstraps a local workspace, manages design tokens, and installs standard dependencies like React and Playwright. No indicators of data exfiltration, malicious persistence, or harmful prompt injection were found; all shell executions and file operations are strictly aligned with the stated purpose of image generation and workspace management.