Table Image

Generate clean table images from data. Perfect for Discord/Telegram where ASCII tables look broken. Supports dark/light mode, custom styling, and auto-sizing...

This skill appears to be what it claims: a Node.js tool that renders table PNGs and optionally wraps them in a Discord-style frame. Before installing/using it, consider the following: - Network access: emoji support will make HTTPS requests to the Twemoji CDN (jsdelivr) at runtime to fetch SVGs; these are cached under the skill directory. If you need offline or air-gapped operation, disable emoji or prepopulate the cache. - Local file reads: the tool will read whatever file path you pass to --data-file and will attempt JSON.parse on its contents. Only pass paths you trust; do not point it at sensitive files unless they contain valid JSON and you intend to expose them. - Discord wrapper default: scripts/discord-wrap.mjs has a hard-coded default avatar path (/data/clawd/2026-01-29-cluka-avatar-v2.png). If you run the wrapper without specifying --avatar, it may attempt to read that absolute path — verify or override the avatar argument to avoid unexpected file reads. - Native dependency: sharp is a native module; npm install will fetch/build native binaries. Review build logs and run in a sandboxed environment if you are concerned about installing native deps on production systems. If you want higher assurance, run the scripts in a sandbox or container, review the included code (emoji.mjs, table.mjs, discord-wrap.mjs), and verify the behavior you expect (e.g., disable emoji fetching) before granting any automated agent permission to invoke the skill autonomously.

Type: OpenClaw Skill Name: table-image-generator Version: 1.4.0 The skill bundle is benign. It generates table images from JSON data using the `sharp` library. File system operations are limited to reading input data/avatar, writing output images, and caching emoji SVGs. Network activity is restricted to fetching Twemoji SVGs from a legitimate CDN (cdn.jsdelivr.net). There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts against the AI agent. The `execSync` calls in the test script (`tests/table.test.mjs`) are used with internally controlled, safe arguments and do not pose a practical shell injection risk.