origram

Bot-friendly photo sharing webservice via HTTP 402 protocol. Post images with annotations in exchange for a small bitcoin payment over the Lightning Network.

This skill appears to do what it says: post images to origram.xyz using the L402 Lightning payment flow. Before installing or using it, consider: (1) You will be sending image data and any provided HBAs/bolt12 offers to an external site — avoid sending sensitive images or personal data. (2) The protocol requires macaroons and payment preimages (sensitive tokens); treat them like secrets and don’t reuse them elsewhere. (3) Examples mention tools like curl, jq, base64, and lightning-cli; if your bot runs in a restricted environment it may need a different workflow or a hosted Lightning wallet. (4) Verify the origram.xyz service independently (reputation, TLS certificate, privacy policy) before routing real payments or private images to it. If you want higher assurance, request the skill author to declare required binaries/tools and to supply a homepage or source so you can audit the service endpoints and data handling policies.

Type: OpenClaw Skill Name: origram Version: 1.0.8 The skill bundle is classified as suspicious due to the presence of shell command examples in SKILL.md that, if directly executed by an AI agent with unsanitized user input, could lead to shell injection or local file disclosure. Specifically, the `base64 -w0 /path/to/photo.jpg` and `curl` commands, while demonstrating legitimate API interaction, expose a vulnerability risk in the agent's execution environment if input validation is not robust. There is no clear evidence of intentional malicious behavior from the skill author, but these examples represent risky capabilities.