Openrouter Image Generation

Generate or edit images through OpenRouter's multimodal image generation endpoint (`/api/v1/chat/completions`) using OpenRouter-compatible image models. Use...

Before installing: (1) Expect to provide an OpenRouter API key (OPENROUTER_API_KEY or pass --api-key) — the registry metadata did not declare this, so verify you are comfortable supplying that secret. (2) The script sends your prompt and any input image to https://openrouter.ai; do not pass sensitive images or prompts you don't want sent to that service. (3) Examples use 'uv run' and require Python 3.10+; ensure your environment supports the recommended runtime or run the script directly with Python. (4) Review the included generate_image.py yourself (it's small and readable); it only posts to openrouter.ai and writes the base64 image result locally, but you should confirm the endpoint and headers are what you expect. (5) If you need the metadata to be accurate for policy/audit purposes, ask the publisher to update required env vars and declared binaries before deploying broadly.

Type: OpenClaw Skill Name: openrouter-image-generation Version: 1.0.0 The skill is classified as suspicious due to critical vulnerabilities in `scripts/generate_image.py`. It allows for Local File Inclusion (LFI) by reading arbitrary files specified by `--input-image` and sending their base64-encoded content to the OpenRouter API. Furthermore, it is vulnerable to Local File Write (LFW) and path traversal, as it writes generated images to an unsanitized path specified by `--filename`, potentially allowing an attacker to write files to arbitrary locations on the filesystem. While the `SKILL.md` does not contain malicious prompt injection, it exposes these vulnerable parameters to the agent, which could lead to shell injection if the agent's command execution is not properly sanitized.