每日 AI Girl 选妃 - 从指定目录（目录里要有图片）随机选择 3 张 AI 女孩图片，让用户选择一个最喜欢的，自动保存为新头像并记录偏好。使用场景：(1) 每日早晨执行选妃任务，(2) 需要更新 AI 助手形象时，(3) 需要随机选择图片用于展示或测试

Do not install or run this skill without review and edits. Specific suggestions: - Inspect and edit the scripts before use: remove hard-coded absolute paths (/Users/qifengxiang, /Volumes/...), replace them with configurable variables (preferably $HOME or env vars the installer can set). - Remove the unnecessary python3 requirement from metadata (it's misleading) or actually use Python if intended. - Fix process-selection.sh so it determines chosen filenames dynamically instead of mapping to hard-coded names (current mapping contradicts the random-selection scripts and may point to stale test data). - Confirm the source directory (/Volumes/...) does not contain sensitive/private images; the skill will read and copy those files and open them in a browser. - If you want to proceed, run the scripts in a sandbox or non-production account first, and change preview/avatar/prefs paths to a directory you control. Prefer adding explicit environment variables or configuration options so the skill doesn't assume another user's home directory.

Type: OpenClaw Skill Name: ai-girl-selection Version: 1.1.1 The skill bundle contains hardcoded absolute paths to a specific local user's home directory (/Users/qifengxiang/) and an external volume (/Volumes/info/), which is highly irregular for a portable skill and poses a privacy risk for the author. Furthermore, 'scripts/process-selection.sh' contains hardcoded filenames for user selections (e.g., '20250725_002805.jpg'), which contradicts the randomized selection logic in 'scripts/select-3.sh' and 'scripts/ai-girl-selection.sh', making the selection process deceptive or broken. While no clear evidence of data exfiltration or remote execution was found, these significant anomalies and the use of unsanitized input in shell scripts warrant a suspicious classification.