TRMNL Display

Generate content for TRMNL e-ink display devices using the TRMNL CSS framework and send via the trmnl CLI. Use when the user wants to display information on their TRMNL device, send messages to an e-ink display, create dashboard content, show notifications, or update their terminal display. Supports rich layouts with the TRMNL framework (flexbox, grid, tables, progress bars, typography utilities).

Key things to check before installing/using this skill: 1) Provenance: the registry entry has no homepage and the source is listed as unknown. Verify the origin of trmnl-cli (npm package) and prefer installing it manually after reviewing the package on npmjs.com or its repository. Do not run global installs blindly. 2) Declared requirements mismatch: the skill metadata lists no required binaries, but SKILL.md instructs using npm and the trmnl CLI. Treat that as an omission — expect to need npm/node and the trmnl-cli executable. 3) External webhooks: the workflow sends HTML to plugin webhook URLs (https://trmnl.com/api/custom_plugins/{uuid} or similar). Only add/send to plugin URLs you control and trust. Any content you send will be visible to the receiving endpoint and (per docs) HTML is NOT auto-escaped on the server side. 4) Sensitive data: do not include passwords, API keys, personal data, or secrets in HTML payloads. The docs show Liquid templates can access user data on the TRMNL side, so avoid embedding anything sensitive in merge_variables.content. 5) Validate locally: use 'trmnl validate --file' locally and inspect the payload before sending. If possible, test with a benign plugin endpoint you control (a simple server you run) to confirm behavior. 6) Package safety: audit the npm package (trmnl-cli) before global installation — check the publisher, recent release notes, and the package contents for unexpected network or filesystem operations. 7) If you need higher assurance: ask the skill publisher for repo/homepage and a signed release or source link; without that information, treat this skill as unvetted. These issues make the skill coherent with its stated function but raise enough provenance and metadata mismatches to avoid a 'benign' verdict without further verification.

Type: OpenClaw Skill Name: trmnl Version: 1.0.3 The skill is classified as suspicious due to two main indicators. Firstly, it instructs the AI agent to install a global npm package (`trmnl-cli@latest`) in `SKILL.md`, which introduces a supply chain risk if the package itself were compromised. Secondly, `SKILL.md` contains a prompt injection instruction to the agent: 'Minimal confirmation only - Do NOT echo content back to chat'. While a plausible benign reason is provided (avoiding verbose HTML output), this instruction attempts to control the agent's communication, which is a risky capability that could be leveraged to hide malicious actions. The skill's core functionality involves sending user-generated HTML to `trmnl.com`, which is aligned with its stated purpose.