Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly aligned with its model-card purpose, but its screenshot renderer can treat configuration text as active HTML, creating unexpected rendering and network-resource risk for untrusted configs.
Review before installing. Use text mode freely for trusted OpenClaw configs, but avoid --image on configs supplied by other people unless rendering is sandboxed with no network access. Treat generated images as potentially attacker-influenced if the source openclaw.json is not trusted, and do not rely on the current sanitization claim.
scripts/md2img.js:7Active HTML Injection Through Untrusted Model Configuration During Image Rendering
The documented purpose is narrowly framed around rendering OpenClaw model inventory from openclaw.json, but the behavior described by analysis indicates the implementation can operate on arbitrary markdown and relies on an external renderer. This mismatch is dangerous because users and orchestration systems may grant trust and inputs based on the declared purpose, while the actual behavior expands into generic content rendering and shell-driven processing that could expose local data or be abused for unintended file handling.
The skill instructs the agent to run local scripts, read configuration files, write output images, and invoke shell commands, but it declares no tool restrictions such as allowed-tools or permissions. That creates unnecessary authority for an agent invoking the skill and weakens policy enforcement, increasing the chance that a compromised or modified skill path could access files or execute commands beyond the intended scope.
The skill's stated purpose is to generate model inventory/model-card images from local data, but this helper achieves that by spawning the external wkhtmltoimage program. Subprocess execution is a broader capability than the manifest suggests and is not explicitly justified in the stated scope, even though it is used for rendering.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
with open(md_file, 'w', encoding='utf-8') as f:
f.write(markdown)
proc = subprocess.run(
['node', md2img, md_file, output_path],
capture_output=True,
text=True,
The manifest describes listing configured models, verifying default/fallback chains, and rendering a model-card screenshot from openclaw.json. While image rendering is in scope, invoking an external runtime via subprocess adds a general command-execution capability that is not justified by the stated purpose of a configuration inspection/rendering skill.
Detected: suspicious.dangerous_exec