pollinations-sketch-note

Generates AI-powered hand-drawn style sketch notes by auto-searching and summarizing topics from Wikipedia and Baidu Baike in three artistic styles.

What to check before installing: - Inspect and edit DEFAULT_OUTPUT_DIR in scripts/generate.py: it is set to /Users/pengshengkai/.openclaw/media (a hardcoded username). Change it to a safe location (e.g., Path.home()/'.openclaw/media' or a configurable path) to avoid files being written to an unexpected absolute path. - Confirm you trust the Pollinations and Tavily API endpoints and that your API keys are from trusted accounts. The script sends your Pollinations key as a request parameter to https://gen.pollinations.ai/image/{prompt} and fetches page content via https://r.jina.ai/..., so expect outgoing network traffic to those hosts. - The package manifests mention 'curl' and other system dependencies, but the script uses Python requests; this is probably harmless but inconsistent—no installer will pull extra binaries automatically, but the docs mention installing requests and pillow. - Run the script in an isolated environment (virtualenv/container) and with dummy or scoped API keys first if possible, to observe behavior. - If you intend to allow the skill to run autonomously, be mindful that it will make outbound HTTP requests whenever invoked; consider network monitoring or restricting keys to minimal scopes. - If anything feels unexpected (unknown endpoints, unexplained file writes), don't provide real API keys until you are satisfied with changes and testing.

Type: OpenClaw Skill Name: pollinations-sketch-note Version: 0.0.1 The skill bundle contains a hardcoded absolute path for a specific user directory (/Users/pengshengkai/.openclaw/media) in scripts/generate.py, which will cause permission errors or execution failures on most systems. Furthermore, the script mandates the configuration of a TAVILY_API_KEY environment variable but never actually utilizes it in the code, instead using the Jina Reader API for web searches. While no direct evidence of intentional malice was found, the requirement for unused sensitive API keys and the presence of user-specific hardcoded paths are significant indicators of poor quality or incomplete development that pose a risk to the user's environment.