Image Generation (Ollama x/z-image-turbo · macOS only)

Génère une image en local via Ollama x/z-image-turbo sur macOS et l'envoie sur WhatsApp selon le prompt donné.

Security Scan

The skill generally matches its stated purpose (generate images with Ollama and send via WhatsApp) but has several incoherences and surprising pieces (undeclared binary requirements, extra FastAPI endpoints that post externally, and hard-coded agent paths) that warrant caution before installing.

Purpose & Capability

The SKILL.md and the code files align on using Ollama to generate images and sending them to WhatsApp, but the registry metadata claims no required binaries or env vars while runner.py clearly calls the 'ollama' CLI and the SKILL.md requires python3 and a TTY. The package omits declaring these required executables (ollama, python), which is an incoherence that could hide unmet runtime assumptions.

Instruction Scope

The runtime instructions (run runner.py with pty=true and then use an internal message tool to send the generated file) are narrowly scoped and plausible. However, the bundle also contains FastAPI-based endpoints (generate_image.py and whatsapp_integration.py) that are not referenced in SKILL.md. whatsapp_integration.py performs an external POST to https://api.whatsapp.com/send, which is a web endpoint (not the documented WhatsApp Business API) and could result in data being transmitted externally if those endpoints are run. These extra server endpoints widen the skill's effective behavior beyond the documented instruction-only flow.

Install Mechanism

There is no install spec (instruction-only), so nothing is automatically downloaded or extracted. That minimizes supply-chain risk. The remaining risk comes from included code files which, if executed by the agent, will run subprocesses and make network requests.

Credentials

The skill declares no required env vars or credentials, but generate_image.py supports OLLAMA_URL and OLLAMA_IMAGE_MODEL via environment variables (with safe defaults). More importantly, sending to WhatsApp normally requires credentials or a proper API; whatsapp_integration.py sends JSON to api.whatsapp.com without any auth, which is suspicious and inconsistent with a legitimate WhatsApp integration. Also SKILL.md hardcodes absolute agent-specific paths (/Users/openclaw/.openclaw/...), reducing portability and revealing host-path assumptions.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide configurations. It contains server code that could be run, but nothing in the metadata asks for persistent installation or elevated privileges.

What to consider before installing

This skill mostly does what its SKILL.md says (use Ollama to generate images and deliver them via a WhatsApp channel), but there are several red flags you should address before installing: 1) The package fails to declare required binaries (ollama and python3) — ensure these are present and expected. 2) The bundle contains FastAPI endpoints (generate_image.py and whatsapp_integration.py) that are not mentioned in the SKILL.md; review those files carefully and do not run them unless you understand and trust their network behavior. 3) whatsapp_integration.py posts to https://api.whatsapp.com/send without auth — that is not a proper WhatsApp Business API call and could leak data or simply fail; verify how you expect WhatsApp delivery to work and whether credentials or an approved gateway are required. 4) The SKILL.md uses hard-coded agent paths (/Users/openclaw/.openclaw/...), which may be correct for your environment but are brittle and should be reviewed. If you decide to proceed, run the skill in a restricted/sandboxed environment, verify 'ollama' is local and trusted, and remove or disable the unused FastAPI endpoints (or require explicit configuration and authentication) to avoid accidental external data transmission.

Ollama x/z-image-turbo Skill

Description

Génère des images via Ollama (modèle x/z-image-turbo) et les envoie sur WhatsApp.

Déclenchement

Quand l'utilisateur demande de générer/créer/dessiner une image (ou variantes), suivre ces étapes :

Étape 1 — Générer l'image

Exécuter via exec avec pty=true (obligatoire) :

python3 /Users/openclaw/.openclaw/skills/ollama-x-z-image-turbo/runner.py \
  --prompt "<PROMPT>" \
  --width 1024 --height 1024 --steps 20 \
  --out /Users/openclaw/.openclaw/workspace/tmp/ollama_image.png -v

Important :

• pty=true est obligatoire (Ollama nécessite un TTY)
• timeout=120 minimum recommandé
• Ajuster --width, --height, --steps selon la demande

Étape 2 — Envoyer sur WhatsApp

Utiliser l'outil message :

action: send
channel: whatsapp
to: <numéro>
message: <légende>
filePath: /Users/openclaw/.openclaw/workspace/tmp/ollama_image.png

Paramètres disponibles

Paramètre	Défaut	Description
--prompt	requis	Description de l'image
--width	1024	Largeur en pixels
--height	1024	Hauteur en pixels
--steps	20	Étapes de débruitage
--seed	aléa	Graine pour reproductibilité
--negative	aucun	Prompt négatif
--timeout	300	Timeout en secondes

Exemples de demandes utilisateur

• "Génère une image d'un chat astronaute"
• "Crée-moi une illustration d'un coucher de soleil"
• "Dessine un robot dans une forêt"
• "Fais une image de …"

Prérequis

• Ollama actif sur http://127.0.0.1:11434
• Modèle installé : x/z-image-turbo:latest