Poster Designer

Create professional posters and visual designs using AI image generation. Supports event posters, product showcases, announcements, and social media graphics...

This skill appears to implement what it claims (poster generation via Gemini) but has a couple of real implementation risks you should consider before installing or running it: - Command injection risk: compose-poster.js builds an ImageMagick command string that includes user-provided text and executes it with execSync. If malicious or poorly sanitized text is passed into title/subtitle/other fields, that could allow arbitrary shell commands to run. Ask the author to switch to child_process.execFile/spawn with argument arrays, or to explicitly sanitize/escape inputs safely. - .env loading risk: generate-poster.js automatically reads ../.env and imports every key into process.env. That can leak or accidentally use unrelated secrets stored in a repository-level .env. Keep other secrets out of that file, or modify the code to only load GEMINI_API_KEY or accept it exclusively from a secure environment store. - API key handling: the script places the API key in the request URL (?key=...), which can be logged by proxies. Prefer Authorization: Bearer headers to reduce accidental exposure. - Run in isolation: until these issues are addressed, run the skill in an isolated environment/container with minimal permissions and no extra secrets present in .env. Review the scripts yourself or request the upstream author to harden input handling and secret usage. If you cannot accept these risks, do not install/run the skill; if you proceed, at minimum provide GEMINI_API_KEY via a controlled environment variable (not a repo .env with other secrets), and avoid passing untrusted text to the CLI without sanitization.

Type: OpenClaw Skill Name: poster-designer Version: 1.0.0 The skill bundle contains a critical shell injection vulnerability in 'scripts/compose-poster.js'. The 'generateImageMagickCommand' function constructs a shell command for 'execSync' using user-provided inputs (such as titles, dates, and venues) with insufficient sanitization (only escaping double quotes), which allows for arbitrary command execution. While the bundle's logic is consistent with its stated purpose of poster design and Gemini API integration, this high-risk coding flaw could be exploited to compromise the host environment.