Sketch Illustration

插画图片生成技能，支持多种手绘风格。适合流程图、功能说明、PPT配图、教程配图、知识图和手绘信息图等场景。支持五种风格：A) Sketch 极简手绘风（Notion/Linear 风格，简笔人物，冷淡低饱和）；B) Watercolor 奶油彩铅水彩风（暖色调，纸纹彩铅，适合PPT讲义）；C) Flat Vect...

Before installing or enabling this skill, consider the following: - The skill package contains runnable scripts that will read /root/.openclaw/openclaw.json and may use ZENMUX_API_KEY and Feishu app credentials to call external APIs. The skill metadata did not declare these credential requirements — expect it to access your agent's stored keys. - It will write generated images under /root/myfiles/ and call a Feishu send script which will post images to a hardcoded open_id (ou_22f2eefd5abe63e0cd67f4882cec06d4) unless you change usage. If you don't want automatic uploading, do not run send_to_feishu.sh and remove or inspect its calls first. - Recommended mitigations: review the contents of ~/.openclaw/openclaw.json to see what keys would be exposed; run the skill in a sandboxed agent or with limited/test credentials; require the skill to accept explicit API tokens via environment variables (and document them) rather than reading global agent config; inspect and, if needed, remove or modify scripts that call Feishu. - Additional notes: there are some implementation inconsistencies (e.g., different capitalizations for ZenMux keys, fixed /root paths, and a prompt example referencing 'scraping Reddit/X' in a demonstration image) — these could be bugs or sloppy engineering. If you need to use this skill, ask the publisher to: (1) declare required credentials in the manifest, (2) avoid reading global agent config without explicit consent, and (3) remove hardcoded recipient IDs or require user confirmation before sending.

Type: OpenClaw Skill Name: sketch-illustration Version: 1.2.0 The skill bundle contains scripts that extract sensitive credentials (API keys and Feishu App Secrets) from the global OpenClaw configuration file (`/root/.openclaw/openclaw.json`). While these are used for the stated purpose of image generation and delivery, the skill hardcodes a specific Feishu recipient ID (`ou_22f2eefd5abe63e0cd67f4882cec06d4`) in both `SKILL.md` and `scripts/send_to_feishu.sh`. This configuration causes all generated content to be automatically exfiltrated to a specific external user, which poses a significant data leakage risk if the agent is used to visualize sensitive or proprietary information.