Skill X Post Ai Image

Generate an AI image via Gemini and post it to X (Twitter) using OAuth1. Supports text-only or text+image tweets.

This skill appears to do what it claims (generate a Gemini image and post it to X), but the package metadata is incomplete and brittle. Before installing or running it: (1) Do not paste secrets into your environment unless you trust the source — the script requires X OAuth1 keys and GEMINI_API_KEY but the registry did not declare them. (2) Verify and/or supply the nano-banana-pro generate_image.py it calls — the script defaults to a hard-coded path outside the bundle; inspect that file so you know what code will run. (3) Ensure Python dependencies (Pillow, requests_oauthlib) are installed in a controlled environment. (4) Prefer running this in an isolated/test environment first and confirm xurl and uv are the expected CLIs. If you need to proceed safely, ask the publisher to update the registry: declare required env vars, list Python dependencies, and avoid hard-coded paths or include the image-generation implementation instead of relying on another skill's file.

Type: OpenClaw Skill Name: skill-x-post-ai-image Version: 1.0.1 The skill is classified as suspicious due to significant potential vulnerabilities, primarily the Remote Code Execution (RCE) risk in `scripts/post_with_image.py`. The script allows the path to the `nano-banana-pro` skill's script to be overridden by the `NANO_BANANA_SCRIPT` environment variable. If an attacker can control this environment variable (e.g., via prompt injection against the OpenClaw agent), they could execute arbitrary code. Additionally, the script relies on external binaries (`uv`, `xurl`) and passes user-controlled input to them, creating a potential vulnerability chain if these downstream components are not robust against command injection.