Wechat Image Generator

Generate beautiful images for WeChat articles (covers, comparisons, charts) with zero token cost. Use when user needs images for social media posts, article...

This skill appears to do what it says: generate static HTML templates and instruct you to take screenshots via a local browser tool. Before installing/using: (1) review and prefer running generate.py (which only writes HTML and prints safe commands) rather than auto_screenshot.py; the latter executes shell commands with shell=True and could be abused if you pass untrusted file paths. (2) The auto-screenshot behavior is partly unimplemented/buggy — screenshots are typically taken by running the printed 'browser open ... && browser screenshot ...' command yourself or using the serve.py + local http.server flow. (3) Run the scripts in a trusted or sandboxed environment if you are unsure about the 'browser' tool implementation. (4) If you plan to integrate this into automation, modify subprocess usage to avoid shell=True and to validate/escape paths to eliminate command-injection risk. Overall the package is coherent with its purpose but exercise standard caution when running helper scripts that invoke shell commands.

Type: OpenClaw Skill Name: wechat-image-generator Version: 1.0.2 The skill contains a critical shell injection vulnerability in `scripts/auto_screenshot.py` and `scripts/generate.py`. Both scripts construct and execute shell commands using `subprocess.run(..., shell=True)` or by printing commands for the agent to execute, without adequately sanitizing user-controlled input, specifically the `--output` path. This could allow a malicious prompt to inject arbitrary commands (e.g., `--output 'foo.png; rm -rf /'`) leading to remote code execution. While this is a severe vulnerability, there is no clear evidence of intentional malicious behavior such as data exfiltration or backdoor installation, aligning it with a 'suspicious' classification rather than 'malicious'.