Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: sends a text prompt to Pollinations.ai to generate an image and saves the result locally.
Install only if you are comfortable sending image prompts to Pollinations.ai and storing generated images in your local OpenClaw media folder. Do not use secrets, private personal data, or confidential business material in prompts.
The skill advertises and requires network-capable behavior via curl/Pollinations but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and user/operator visibility into what external actions the skill may perform, making unintended or over-broad network access easier to miss during review and execution.
The skill invites users to submit arbitrary prompts for image generation but does not warn that those prompts are transmitted to a third-party service. Users may unknowingly send sensitive, proprietary, or personal data off-platform, creating privacy, compliance, and data-handling risks.
The script transmits the user-provided prompt to a third-party service at image.pollinations.ai, which can expose sensitive or personal text to an external provider without explicit disclosure at the point of use. In an agent skill context, users may assume prompts stay local unless clearly warned, so this creates a real privacy and data-handling risk even though the behavior is functionally necessary for the skill.
The script saves generated image content to a persistent directory under the user's home folder without making file creation/storage behavior especially prominent. This can leave behind sensitive or unexpected artifacts on disk, particularly if prompts or generated images contain private material or if users expect ephemeral operation.
No suspicious patterns detected.
