URL to PNG

Convert URL to PNG suitable for mobile reading.

This skill appears to do exactly what it claims: it runs shot-scraper (via the uv tool) to capture a mobile-formatted PNG of a given URL. Before installing or enabling it everywhere, consider: - Why is always:true set? That forces the skill to be included in every agent run; ask the maintainer to remove or justify this flag. - The installer will download and install shot-scraper and a Chromium runtime — expect a large download and verify you trust 'uv' and 'shot-scraper' (and their default download sources). If you operate in a restricted environment, block or review those downloads first. - The skill will load the target webpage (the user-supplied URL) in a browser; treat user-supplied URLs as untrusted content (could trigger remote requests, ads, trackers, or malicious pages). Limit who can provide URLs if that's a concern. - There are no credential requests and scripts don't read other files, which is good. But if you need stronger assurance, ask for the canonical upstream repository or author verification and request removal of always:true prior to enabling globally.

Type: OpenClaw Skill Name: url2png Version: 0.0.2 The 'url2png' skill's primary function is benign, converting URLs to PNGs using legitimate tools like `shot-scraper`. However, the `url2png.sh` script is vulnerable to shell injection. The `outdir` variable, which can be controlled by user input, is directly used in `mkdir -p ${outdir}` and `cd ${outdir}` commands without proper sanitization. This allows an attacker to execute arbitrary commands by providing a specially crafted output directory path, posing a significant remote code execution risk. This is a critical vulnerability, but not evidence of intentional malicious design.