MenuVision

Build beautiful HTML photo menus from restaurant URLs, PDFs, or photos using Gemini Vision and AI image generation

This skill appears to do what it says, but consider these before installing: 1) Privacy: PDFs and photos you provide will be sent to Google's Gemini APIs for extraction and image generation — do not upload sensitive personal data unless you're comfortable with Google processing it. 2) API key scope: use a dedicated Google API key or service account with minimal required permissions and rotate it if shared. 3) Local scripts: the agent will generate and run Python scripts locally (ensure python3 is the expected interpreter). 4) Publishing: if you choose to publish to GitHub Pages, the agent should prompt for explicit GitHub credentials; do not provide tokens unless you trust the action. 5) Source provenance: the metadata points at a GitHub repo (github.com/ademczuk/MenuVision); if provenance matters, review that repository or contact the author before trusting the skill.

Type: OpenClaw Skill Name: menuvision Version: 1.0.1 The skill bundle is classified as suspicious due to its extensive use of high-risk capabilities, including the execution of `git` commands with a `GITHUB_PAT` for publishing to GitHub Pages, the installation and use of `playwright` (a headless browser) for web scraping, and broad file system access. While these capabilities are necessary for the skill's stated purpose of building and optionally publishing restaurant menus, they introduce significant attack surface and potential for misuse. There is no clear evidence of intentional malicious behavior (e.g., data exfiltration to unauthorized endpoints, persistence mechanisms, or obfuscation) within the `SKILL.md` instructions or implied code logic. However, the power of these operations, particularly the `GITHUB_PAT` for authenticated `git push` and the `playwright` browser, means that a compromised agent or a malicious input URL could lead to severe consequences, classifying it beyond benign.