Thor Generator

Generate high-quality images locally using the ComfyUI Thor pipeline from user-provided text prompts.

This skill tells the agent to run a local shell command that activates a virtualenv and executes thor_generate_image.py in ~/ComfyUI — before installing or enabling it: 1) Verify ~/ComfyUI, the venv, and thor_generate_image.py actually exist on the target machine. 2) Inspect the contents of thor_generate_image.py to ensure it only performs the expected image-generation steps and does not exfiltrate data or run other system commands. 3) Ensure python3 and the virtualenv are from trusted sources. 4) Consider running the exact command manually in a controlled environment to observe behavior and outputs. 5) If you cannot inspect or verify the script/repo, treat the skill as risky and avoid granting the agent execution rights. Providing explicit declared requirements (python3, path to ComfyUI, and the script) or bundling the script for review would reduce the concern.

Type: OpenClaw Skill Name: thor-generator Version: 1.0.0 The `SKILL.md` file instructs the AI agent to execute a shell command that directly embeds user input (`{{prompt}}`) without explicit sanitization or robust quoting. This creates a significant shell injection vulnerability, allowing an attacker to potentially execute arbitrary commands on the host system by crafting a malicious prompt. While the skill's stated purpose is benign, this critical flaw makes the bundle suspicious due to the high risk of unauthorized command execution.