Qwen Comic Gen

Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image; 1K...

What to consider before installing or running this skill: - Don’t run it as-is. The package contains a large unrelated workspace and plaintext credentials (API keys, app secrets, tokens) which are exposed in files included with the skill. An image-generation helper does not need these. - Verify the actual script to be executed. Open the generate_image.py file that will be run (and any helpers it imports) and search for network calls (requests/http client), file I/O beyond image read/write, and any code that reads other config files or home-directory paths. Confirm endpoints and that no unexpected remote endpoints are contacted. - Confirm script path and provenance. SKILL.md references ~/.codex/skills/nano-banana-pro/scripts/generate_image.py but repository paths differ (scripts/generate_image.py, clawhub skills/... ). Ask the publisher which file is authoritative and why the bundle contains unrelated workspace files. - Remove or secure embedded secrets. The bundle includes plaintext secrets (example: 2026-3-10afu的js备份.txt and various config files). These should be removed before installing or the package should be republished without any secret/config dumps. - Run in an isolated sandbox. If you need to test, run the script in a disposable VM/container with no access to your real home or credentials to limit blast radius. - Avoid pasting API keys in chat. Prefer using environment variables set only in a controlled runtime, and never pass sensitive keys in a public or untrusted UI. - Ask the author for a minimal, audited release. A trustworthy skill should contain only the files needed (single controlled script or small package), clear install instructions from a known release host (GitHub release, official registry), and no extraneous secrets or large unrelated workspaces. If you want, I can: - Inspect the specific generate_image.py files in this bundle (show me the file contents) and list every external endpoint and file path they touch. - Search the repo for 'GEMINI', 'apiKey', 'appSecret', 'token', 'http', 'requests', 'urllib' to highlight suspicious code paths.

Type: OpenClaw Skill Name: qwen-comic-gen Version: 1.0.0 The skill bundle contains several high-risk security vulnerabilities, most notably a potential Remote Code Execution (RCE) flaw in 'mermaid_generator.py' and 'scripts/mermaid-generator.py' due to the use of 'shell=True' within 'subprocess.run' on user-provided inputs. Additionally, multiple scripts (e.g., 'fetch_feishu_docs.py', 'scripts/debug-search-step.py', 'scripts/vectorize-and-store.py', and 'vectorize_all.py') contain hardcoded Aliyun API keys and Feishu App Secrets. While these appear to be functional tools for a personal automation environment, the combination of exposed credentials and unsafe command execution patterns poses a significant security risk.