smart-image-loader

Smart image loader that handles both URLs and local files, automatically downloads URLs to temporary locations, and displays images using the read tool. Use when a user wants to view or display an image, whether it's a web URL or a file in the workspace.

This skill appears to do exactly what it says: download image URLs to a temp folder or validate local files and return a path for the agent's read tool. Before installing, consider: (1) the agent will be able to fetch arbitrary URLs — if you need to restrict hosts, enforce that at the agent/network layer; (2) the SKILL.md suggests using 'rm <file_path>' to clean up temp files — ensure the agent is not allowed to remove sensitive paths and only deletes paths returned by the script; (3) the script has a minor bug: on a URL-download error it calls cleanup_file(os.path.join(temp_dir, '*')) which won't remove the temp directory and is a no-op; a proper cleanup would use shutil.rmtree(temp_dir) or remove the exact file path; and (4) there are no requested credentials or external installs. If you want extra assurance, review or test the script in a sandboxed workspace and consider hardening path validation and cleanup logic before use.

Type: OpenClaw Skill Name: smart-image-loader Version: 1.0.0 The skill is designed to load and display images from URLs or local files, downloading URL content to temporary locations. The Python script uses standard libraries for network requests (`urllib.request`) and file system operations (`os`, `tempfile`), correctly utilizing `tempfile.mkdtemp()` to secure temporary file storage. The `SKILL.md` instructs the agent to use the `read` tool for display and `exec` with `rm` for cleaning up temporary files created by the skill, which is a legitimate and controlled operation on files within a secure temporary directory. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempting to subvert the agent's core directives beyond the stated purpose.