Image Generation (Ollama x/z-image-turbo · macOS only)

Génère une image en local via Ollama x/z-image-turbo sur macOS et l'envoie sur WhatsApp selon le prompt donné.

This skill mostly does what its SKILL.md says (use Ollama to generate images and deliver them via a WhatsApp channel), but there are several red flags you should address before installing: 1) The package fails to declare required binaries (ollama and python3) — ensure these are present and expected. 2) The bundle contains FastAPI endpoints (generate_image.py and whatsapp_integration.py) that are not mentioned in the SKILL.md; review those files carefully and do not run them unless you understand and trust their network behavior. 3) whatsapp_integration.py posts to https://api.whatsapp.com/send without auth — that is not a proper WhatsApp Business API call and could leak data or simply fail; verify how you expect WhatsApp delivery to work and whether credentials or an approved gateway are required. 4) The SKILL.md uses hard-coded agent paths (/Users/openclaw/.openclaw/...), which may be correct for your environment but are brittle and should be reviewed. If you decide to proceed, run the skill in a restricted/sandboxed environment, verify 'ollama' is local and trusted, and remove or disable the unused FastAPI endpoints (or require explicit configuration and authentication) to avoid accidental external data transmission.

Type: OpenClaw Skill Name: ollama-x-z-image-turbo Version: 1.0.0 The skill bundle is designed to generate images using a local Ollama instance and send them via WhatsApp. The `SKILL.md` instructs the agent to execute `runner.py` with user-provided prompts and then use an internal `message` tool to send the generated image. The `runner.py` script executes the `ollama` command via `subprocess.run`, passing the user prompt as a distinct argument, which mitigates shell injection risks. Network calls are limited to the local Ollama instance (`http://127.0.0.1:11434`) and the official WhatsApp API (`https://api.whatsapp.com/send`) for its stated purpose. There is no evidence of credential theft, data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection against the agent itself.