Generate images via OpenRouter (google/gemini-2.5-flash-image) and send to Telegram. Use when user asks for AI-generated images in TG.

This skill appears to implement what it claims, but there are important issues to consider before installing: - Metadata mismatch: The skill will fail without OPENROUTER_API_KEY, but that env var is not declared in the skill metadata. Only set that API key if you trust the skill and the OpenRouter account. - Network risk: The script downloads whatever URLs are returned by OpenRouter. If an attacker or an unexpected response supplies a URL, the agent will fetch it (possible SSRF or access to internal resources). Consider running this in a network-restricted sandbox or adding URL host validation/allowlist. - Dependency note: The script requires Python and the requests library; the skill does not declare those requirements. Ensure your runtime provides them. - Code issues: There's a bug in _extract_image_urls (uses an undefined b64_json variable) that may raise an exception; you may want to inspect/fix the script before use. Recommendations: - Ask the publisher to update the registry metadata to declare OPENROUTER_API_KEY as a required credential and list runtime dependencies. - Prefer running the skill in an isolated environment (no access to internal networks) and/or modify the script to validate/whitelist image hosts and limit timeouts/response sizes. - Review or test the script locally first. If you don't trust the source, avoid providing your OpenRouter API key.

Type: OpenClaw Skill Name: gemini-tg-image-gen Version: 1.0.0 The skill bundle is benign. It generates images using the OpenRouter API and sends them to Telegram, as described. The `SKILL.md` instructions are clear and do not contain any prompt injection attempts or instructions to deviate from the stated purpose. The `scripts/generate_image.py` script correctly interacts with `openrouter.ai`, reads the `OPENROUTER_API_KEY` environment variable, and saves generated images to a temporary workspace directory (`/root/.openclaw/workspace/tmp`). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation. All actions are aligned with the stated purpose.