Smart Illustrator

智能配图与 PPT 信息图生成器。支持三种模式：(1) 文章配图模式 - 分析文章内容，生成插图；(2) PPT/Slides 模式 - 生成批量信息图；(3) Cover 模式 - 生成封面图。所有模式默认生成图片，`--prompt-only` 只输出 prompt。支持 Bento Grid 功能展示图风格...

This skill is plausible for generating illustrations, but there are important mismatches you should understand before installing or running it: - The SKILL/README instruct the agent to use GEMINI_API_KEY and to call local scripts, yet the registry metadata declares no required environment variables or config paths. Treat that as a red flag: the skill will likely expect an API key and local files even if not declared. - If you clone the repo into ~/.claude/skills (as README suggests), inspect any scripts (the scripts/ directory) before running npx/bun on them. Executing unreviewed scripts from a repo can run arbitrary code on your machine. - Review the styles/*.md files: they contain long System Prompt text that the skill instructs the agent to extract and use as the System Prompt for generation. That effectively injects LLM instructions at runtime — review these prompts for undesired behavior before use. - Be cautious about automatic clipboard copying and files written under ~/.smart-illustrator and /tmp; sensitive content (articles, prompts) could be stored or exposed. If you must use it, run in a sandboxed environment, set API keys with least privilege, and keep the skill's files under version control so you can audit changes. If you want to proceed: ask the author for an explicit list of required env vars and an install script you can audit, or run the skill in a disposable environment until you've inspected the scripts and verified precisely which credentials are used and where data is written/transmitted.

Type: OpenClaw Skill Name: smart-illustrator Version: 1.0.0 The 'smart-illustrator' skill bundle is a legitimate automation tool designed to generate article illustrations and presentation infographics using Gemini, Excalidraw, and Mermaid engines. While the SKILL.md instructions direct the agent to perform high-privilege actions—including executing shell commands via 'npx', accessing the 'GEMINI_API_KEY' environment variable, and interacting with the system clipboard via 'pbcopy'—these behaviors are strictly aligned with the stated purpose of rendering diagrams and calling image generation APIs. No evidence of data exfiltration, unauthorized persistence, or malicious prompt injection was found; the 'forced rules' in the instructions are functional constraints intended to ensure consistent output quality.