Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Memegen
v1.2.0Generate meme images using the memegen.link API. Use when the user asks to create, make, send, or generate a meme, funny image, reaction image, or similar re...
⭐ 0· 53·0 current·0 all-time
byArtemio Padilla@artemiopadilla
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, examples, and included scripts all align with a memegen skill: building memegen.link URLs, optional Imgflip/Reddit/Giphy trending fetchers, and a Pillow-based deep-fry post-processor. No unrelated credentials or binaries are requested.
Instruction Scope
Runtime instructions include examples that tell an agent to download external images, run curl/subprocess/execSync, and (explicitly) to include SKILL.md content in the model/system prompt. These are expected for improving template selection but giving the skill content direct control of the system prompt increases its influence over agent behaviour — review before embedding verbatim.
Install Mechanism
No install spec is declared (instruction-only). Scripts are included in the package but nothing will be auto-downloaded or executed at install time.
Credentials
No required environment variables or credentials are declared. Optional features (Reddit/Giphy trending fetchers) need their own API keys as documented, which is reasonable and scoped to those optional features.
Persistence & Privilege
always:false and user-invocable:true (normal). The guidance suggests agents may maintain a local meme-history.json — that implies writing to the agent workspace but is limited in scope. The main privilege concern is the recommendation to copy SKILL.md into system prompts (see instruction_scope).
Scan Findings in Context
[system-prompt-override] expected: SKILL.md explicitly instructs integrators to include its content in the LLM system prompt to improve template selection. This behaviour is functionally expected for skills that provide a knowledge file, but it increases the skill's ability to influence agent decisions and should be reviewed before blindly pasting into privileged prompts.
Assessment
This skill behaves like a normal memegen helper: it builds memegen.link URLs, downloads images, and optionally runs included scripts (deep-fry, Imgflip/Reddit/Giphy fetchers). It requests no credentials by default. Two things to consider before installing: (1) SKILL.md suggests copying its entire content into your model's system prompt — that will change the assistant's behavior, so don't paste it into privileged system prompts unless you trust the content. Instead, extract just the parts you need (URL rules, template taxonomy). (2) The optional helper scripts fetch external data and may require API keys (Reddit/Giphy) or pip installing Pillow for deep-frying; run those scripts only in a sandbox or review their code. Otherwise the skill is internally consistent and proportionate for its stated purpose.integrations/langchain.md:86
Prompt-injection style instruction pattern detected.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.Like a lobster shell, security has layers — review code before you run it.
humorvk97d62n50p589aey201va6zxw584rrbrimagesvk97d62n50p589aey201va6zxw584rrbrlatestvk97d62n50p589aey201va6zxw584rrbrmemesvk97d62n50p589aey201va6zxw584rrbr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.