Product Image Generator

Generates professional product images for e-commerce platforms (Amazon, Shopify, eBay, etc.). Supports 8 visual styles and 6 scene types optimized for differ...

This skill's docs and presets look legitimate for producing e‑commerce images, but important runtime details are missing. Before installing or running it: 1) Ask the author what actually generates the PNGs (local binary, local image model, or an external API) and whether any network calls will be made; 2) Confirm the exact filesystem paths it will read/write and whether you are comfortable allowing writes to $HOME/.teamclaw-skills/ and your project directory; 3) If the skill needs an external image API or binary, require the author to declare that and any credential requirements; 4) Run first in an isolated/test environment (or sandbox) so it cannot unexpectedly modify other files; 5) If you accept it, review the created EXTEND.md and generated prompts to ensure no sensitive information is being recorded or transmitted.

Type: OpenClaw Skill Name: product-image-generator Version: 1.0.0 The skill is classified as suspicious due to the presence of a shell command (`test -f`) directly embedded in `SKILL.md`, which represents a potential shell injection vulnerability if the AI agent executes markdown content without proper sandboxing. Additionally, the `--ref <path>` option allows user-controlled file paths to be incorporated into prompts for the image generation model, posing a prompt injection vulnerability against the model itself. While these do not show clear evidence of intentional malicious behavior (e.g., data exfiltration or system compromise), they are risky capabilities and vulnerabilities that could be exploited.