Poster Forge

Universal image and poster generator with Chinese/English text support. Use when asked to create posters, social media images, cover images, infographics, co...

This skill appears to do what it says, but be aware it performs network operations: it downloads fonts from GitHub raw URLs and sends prompts to Pollinations.ai to generate base images, and it uses headless Chromium to render HTML templates. If you have privacy concerns about sending prompts/images to an external service, run the script in an isolated environment or use the HTML/text engines only (Chromium/PIL) which can operate offline. Also ensure you have Python 3 and Pillow installed, and that running headless Chromium with --no-sandbox is acceptable in your environment. Finally, review licensing for any fonts or third-party services if you plan commercial use.

Type: OpenClaw Skill Name: poster-forge Version: 1.0.0 The skill is functional but contains security vulnerabilities in `scripts/generate.py`. It uses `subprocess.run` to execute `curl` for downloading external fonts and images, and it renders HTML templates using a headless Chromium browser with the `--no-sandbox` flag. Crucially, the HTML templates are constructed using f-strings that directly inject user-provided arguments (like `--title` and `--code-content`) without sanitization, which could allow for injection attacks within the browser context. While these behaviors align with the stated purpose of generating posters, the lack of input validation and the use of risky browser flags meet the criteria for a suspicious classification.