Takes a URL, HTML file path, or raw HTML code and generates a printable image.

This skill appears to perform the advertised task, but exercise caution before installing or running it: - The script calls 'npx --yes agent-browser' at runtime, which will download and execute code from npm. Only proceed if you trust the 'agent-browser' package and the npm environment, or modify the skill to pin a known-safe version or vendor the renderer. - The metadata does not declare that Node/npx are required; ensure your environment has Node and npx if you intend to use it. - Avoid passing URLs that contain credentials (user:pass@host) because the script may echo the constructed command on error and leak those credentials. - The skill can access local files (it accepts absolute file paths). Do not allow it to run on sensitive filesystem paths unless you trust the environment and the renderer. Recommended mitigations: pin or vendor the agent-browser executable, declare Node/npx as required binaries in metadata, remove or sanitize command-string output on error, and run the skill in a restricted/sandboxed environment if you cannot fully trust npm package provenance.

Type: OpenClaw Skill Name: html-to-image Version: 1.0.0 The skill contains a critical shell injection vulnerability in `src/main.sh` because it uses `eval` to execute a command string constructed with unsanitized user input (`source_content`). While the script's logic is consistent with its stated purpose of converting HTML or URLs to images using `agent-browser`, the lack of input validation allows for arbitrary command execution on the host system. No clear evidence of intentional malice or data exfiltration was found, but the implementation is highly insecure.