z-card-image

生成配图、封面图、卡片图、文字海报、公众号文章封面图、微信公众号头图、X 风格帖子分享图、帖子长图、社媒帖子长图。适用于帖子类型数据、post data、social posts、tweet/thread、转发推文、转发帖子、小绿书配图、图片封面、card image。

This skill appears to do exactly what it says: render templates into PNGs using Python and headless Chrome (ffmpeg only for the wechat-cover-split template). Before installing or running: 1) ensure python3 and Chrome/Chromium are available and that you are comfortable the agent can run headless Chrome and (optionally) ffmpeg; 2) be aware the code executes subprocesses (chrome and ffmpeg) and creates temporary HTML files — run it in an environment where executing those binaries is acceptable; 3) note the developer-default absolute icon path (/Users/aatrox/...) may not exist on your machine—if missing, specify --icon or update the template paths; 4) no secrets or network calls are requested by the skill, but you should still review the templates/assets if you plan to render sensitive content. If you want extra assurance, run the scripts locally with safe sample input to confirm behavior before granting agent-level use.

Type: OpenClaw Skill Name: z-card-image Version: 1.1.0 The skill bundle provides Python scripts to render text into images using headless Google Chrome and ffmpeg. It is classified as suspicious because it utilizes risky capabilities, such as executing shell commands via `subprocess.run` and allowing the AI agent to write files to arbitrary absolute paths provided via the `--out` parameter (as explicitly instructed in `SKILL.md`). These behaviors, while plausibly needed for the stated purpose, lack sufficient input sanitization and create a risk of arbitrary file writes. Additionally, `render_card.py` and `references/wechat-cover-split.md` contain hardcoded absolute paths to a specific local user directory (`/Users/aatrox/...`), which is a poor security practice and reveals information about the development environment.