Gemini Painter

• Risk level: Low
• Analyzed: Feb 24, 2026, 8:50 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code and instructions match its stated purpose (generating images via a local Gemini Imagen endpoint and saving them to an archive), with minor implementation quirks you should be aware of before use.

This skill appears to do what it claims: it POSTs prompts to a Gemini-compatible service at 127.0.0.1:8317 and saves returned data-URI images to an archives folder. Before installing, consider: (1) confirm you run and trust a local Gemini proxy at 127.0.0.1:8317; the skill only communicates with localhost, not external hosts. (2) The script uses a hard-coded API_KEY ("OpenClaw") instead of a declared secret — if you expect to use a real key, the script will need modification to read a proper credential. (3) It reads USERPROFILE to decide where to save files; on non-Windows systems USERPROFILE may be unset and the code falls back to a Windows path, which could create unexpected directories — you may want to edit the script to use os.path.expanduser('~') or a configurable path. (4) The skill will write files to your filesystem under .openclaw/workspace/archives/images — review or sandbox if you have concerns. If you want stronger guarantees, open the script, replace the API_KEY and base URL with your secure configuration, and/or adjust the save path behavior before enabling autonomous runs.