Microsoft Foundry image generation

Azure Foundry image generation skill for OpenClaw; generates images via a Foundry deployment and returns image bytes or URLs.

This skill appears to do exactly what it says: call your Azure Foundry images deployment and save the returned image bytes. Before installing, ensure you only provide a Foundry API key with the minimum necessary permissions, verify the FOUNDRY_ENDPOINT is correct and points to your service, and be aware the example writes temporary files to /tmp (ephemeral). Also confirm your environment has curl, jq, and a compatible base64 utility. If you need stricter hostname validation, review the endpoint regex in the SKILL.md or restrict network access accordingly.

Type: OpenClaw Skill Name: ms-foundry-image-gen Version: 1.0.6 The skill is designed for Azure Foundry image generation and includes positive security measures like endpoint validation and safe prompt handling using `jq --arg`. However, it directly interpolates the `$FOUNDRY_DEPLOYMENT` and `$FOUNDRY_API_VERSION` environment variables into the `curl` URL in `SKILL.md` without explicit validation or escaping. This creates a potential shell injection vulnerability if an attacker can control these environment variables, which could lead to arbitrary command execution on the agent. While the skill explicitly states an intent to prevent injection risks, this oversight constitutes a significant vulnerability, classifying it as suspicious rather than benign.