Mixtiles It

Send a photo to Mixtiles for ordering wall tiles. Use when a user forwards/sends a photo and wants to order it as a Mixtile, add it to their Mixtiles cart, o...

This skill appears to do what it says, but review these practical points before installing: - Privacy: by default the script uploads images to a public Cloudinary 'demo' account (unsigned preset). Uploaded images become publicly accessible via their URLs. If this is sensitive content, do not use the default — configure your own Cloudinary credentials/preset or avoid the skill. - Dependencies: the Python script calls curl via subprocess; ensure curl is available on systems that will run the agent, or modify the script to use Python HTTP libraries if preferred. - Custom upload endpoint: the script accepts MIXTILES_UPLOAD_URL and MIXTILES_UPLOAD_KEY env vars; only set these to trusted endpoints, since they will receive your image data. - Network usage: the skill performs outbound network requests (downloading image URLs and uploading to Cloudinary). If you need to restrict network access for the agent, do so before enabling the skill. - Audit: if you have strong privacy or security requirements, consider reviewing or running the script in a sandboxed environment and/or replacing the Cloudinary defaults with your own account and unsigned preset settings.

Type: OpenClaw Skill Name: mixtiles-it Version: 1.1.0 The skill bundle is benign. The `SKILL.md` provides clear instructions for the AI agent without attempting prompt injection for malicious purposes. The `scripts/mixtiles-cart.py` script implements the stated functionality of processing images and generating Mixtiles links. It includes robust SSRF protection via the `_validate_url` function, which checks URL schemes, blocks internal hostnames, and resolves IPs to prevent access to private networks. Shell injection risks are mitigated by using `subprocess.run` with a list of arguments (defaulting to `shell=False`) when invoking `curl`. Environment variables are used for legitimate configuration, and there is no evidence of data exfiltration, persistence, or other malicious intent.