Openclaw-X-article-cover-generator

Generate OpenClaw-themed X article covers with the lobster logo on the right quarter and text on the left three quarters, ensuring clear, readable design.

This skill appears internally consistent with its purpose, but before using it: 1) only provide image reference files that you are comfortable sending to an external service (do not pass sensitive files such as private keys or documents); 2) verify and trust the BLT API endpoint (https://api.bltcy.ai) and its privacy/security practices because local files will be uploaded or referenced; 3) prefer passing a URL to a non-sensitive hosted image (OSS long link) rather than a local path when possible; 4) confirm the BLT_API_KEY is scoped appropriately (rotate/revoke if exposed) and avoid reusing high-privilege keys; 5) if you need higher assurance, run the script in an isolated environment and review/modify the code to enforce stricter file-type checks before upload. Because there is no homepage or publisher metadata, treat the endpoint and owner as unverified — exercise caution.

Type: OpenClaw Skill Name: openclaw-x-article-cover-generator Version: 1.0.2 The skill is classified as suspicious due to critical vulnerabilities in `scripts/generate_cover.py`. Specifically, the `normalize_reference` and `b64_data_uri` functions allow Local File Inclusion (LFI), enabling an attacker to read arbitrary local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and exfiltrate their base64-encoded content to the external API `https://api.bltcy.ai`. Additionally, the `save_from_url` function allows arbitrary file writes if the `--output` argument is controlled, and the `build_prompt` function is vulnerable to prompt injection against the external AI model via unsanitized user input for `--title` and `--subtitle`.