Playwright Dev

Generate/edit images with Nano Banana Pro (Gemini 3 Pro Image). Use for image create/modify requests incl. edits. Supports text-to-image + image-to-image; 1K...

Do not trust or run scripts from this skill bundle as-is. Specific steps to consider: - Stop and inspect: The package includes many unrelated files and at least one file with plaintext secrets (API keys, app secrets, tokens). Do not run any scripts until these are removed/validated. - Verify the implementation: Open the generate_image.py(s) that SKILL.md refers to and audit for arbitrary network calls, file reads/writes, or code that uploads files or environment variables to unknown endpoints. Search for any occurrences of hardcoded URLs, 'requests', 'urllib', 'socket', or subprocess/exec calls. - Remove secrets and unrelated files: If you only want the image helper, extract the minimal generate_image.py and supporting modules; remove the rest of the workspace and any files containing credentials. Ensure no plaintext secrets remain. - Avoid sharing keys in chat/CLI: Prefer setting GEMINI_API_KEY in a safe environment and avoid pasting API keys into chat messages or command-line arguments that could be logged. - Run safely: If you must try the skill, run it in an isolated environment (throwaway VM or container) with network access restricted, and monitor outbound connections. Inspect network traffic to confirm calls go only to expected Gemini/Google endpoints. - Consider sourcing: The skill has no homepage and unknown source; prefer official SDKs or well-known wrappers for Gemini / Google image APIs. If you want, I can (a) scan the generate_image.py file for network/call patterns and suspicious code, (b) search the bundle for plaintext secrets and list them so you can remove them, or (c) help extract a minimal, sanitized version of the image script that only connects to the documented Gemini endpoint.

Type: OpenClaw Skill Name: playwright-dev Version: 1.0.0 The skill bundle contains multiple hardcoded sensitive credentials, including an Aliyun API key (sk-1f3847debc3e492e81f64115b20c6d82) and a Feishu App Secret (t0am3JU79N9TSEPgrk7GKbVLHmCdRGUe) across several files like fetch_feishu_docs.py and vectorize-and-store.py. It also utilizes risky execution patterns, such as using execSync to run system commands like robocopy and chrome.exe in hooks/gateway-restart-protection/handler.js and scripts/triple-line-sync.js. While these appear to be part of an extensive personal automation framework ('Axiang'), the inclusion of live secrets and the use of shell execution for file management present significant security vulnerabilities.