Pollinations Image Generator

Generate detailed images from text prompts using Pollinations.ai models with optional configuration, model selection, and advanced settings.

This skill appears to implement a Pollinations image generator and is readable, but exercise caution before installing: 1) The scripts load .env files from the skill parent directory and the current working directory — move or audit any .env files that contain secrets so unrelated credentials aren't picked up. 2) The env loader uses eval to probe variables; untrusted .env contents could be risky—inspect .env files before running. 3) The scripts assume common CLI tools (curl, file, stat/realpath, sed, grep; python3 optional) but the metadata didn't declare these—ensure your environment provides them. 4) If you want to limit exposure, run the skill in an isolated directory or container, and don't keep sensitive keys in parent or current-directory .env files. Reviewing the provided generate.sh and lib/models.sh (they are included) is a good first step; if you need lower risk, ask the maintainer to remove loading of ../.env and $PWD/.env or to explicitly document required binaries and environment behavior.

Type: OpenClaw Skill Name: pollinations-image Version: 1.0.0 The `generate.sh` script is classified as suspicious primarily due to its use of `eval` to execute the `curl` command for image generation. While attempts are made to sanitize inputs (e.g., URL encoding prompts, using `basename` for filenames), `eval` is a high-risk primitive that introduces a shell injection vulnerability if any part of the command string is not perfectly escaped or controlled. Additionally, the script attempts to load environment variables from `"$SCRIPT_DIR/../.env"`, which could inadvertently load an `.env` file from an unexpected parent directory, leading to unintended configuration or credential exposure. These are significant vulnerabilities, not clear malicious intent.