Quickly send local images to channel. Auto-compress large images, copy small images directly.

This skill appears to do what it says: compress or copy a local image then call your openclaw CLI to send it. Before installing/using: 1) Ensure you have the openclaw CLI and the sharp Node package installed. 2) Be aware of two implementation issues you may want to fix: the script uses the literal path "~/.openclaw/..." instead of expanding ~ to the home directory (so it may create a directory named "~" instead of using your home), and it spawns the openclaw command with shell: true and unescaped arguments — if you or another agent can pass untrusted file paths, that could permit shell injection. 3) Confirm you're comfortable with the script deleting the temporary file after sending (it skips deletion for channel 'qqbot'). If you want to harden it, update TMP_DIR to use os.homedir(), and invoke the CLI with spawn/execFile without shell or ensure arguments are safely escaped.

Type: OpenClaw Skill Name: fast-image Version: 1.0.2 The skill `fast-image` is classified as suspicious due to a shell injection vulnerability in `send_image.mjs`, where `child_process.spawn` is invoked with `shell: true` using unsanitized user-provided arguments. This allows for arbitrary command execution if parameters such as `target` or `message` contain shell metacharacters. Additionally, the script lacks path validation for the `image_path` parameter, which could be exploited to read and exfiltrate sensitive local files.