Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Rendshot

v1.0.0

Image generation and screenshot tool using Rendshot. Use when the user asks to generate images from HTML/CSS, take website screenshots, render templates to i...

0· 65·0 current·0 all-time
byMartian@zoohero500

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zoohero500/rendshot.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Rendshot" (zoohero500/rendshot) from ClawHub.
Skill page: https://clawhub.ai/zoohero500/rendshot
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install rendshot

ClawHub CLI

Package manager switcher

npx clawhub@latest install rendshot
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name and description (image generation, HTML→image, screenshots, templates) match the SKILL.md and reference docs. The provided MCP tool names and API/CLI/SDK examples are coherent with the stated purpose. Minor inconsistency: the docs show use of an API key (RENDSHOT_API_KEY) and external endpoints, but the skill metadata lists no required environment variables or primary credential.
!
Instruction Scope
Runtime instructions explicitly instruct sending HTML, screenshots of arbitrary URLs, and templates to an external service (api.rendshot.com). That behavior is consistent with the feature set, but it means user-provided or internal URLs and HTML will be transmitted off-host. The SKILL.md does not instruct reading local files or unrelated system state, which is good, but the broad permission to screenshot arbitrary URLs is a potential SSRF/data-exfil problem if not limited or consented to.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest installation risk. The references include example install commands (npm, pip) for the external Rendshot SDK/CLI, but the skill itself does not install anything.
!
Credentials
The included references and examples expect an API key (RENDSHOT_API_KEY / Authorization: Bearer rs_live_xxx) to authenticate to api.rendshot.com, but the skill metadata declares no required env vars or primary credential. Requiring a service API key is reasonable for this purpose, but the omission in metadata is an inconsistency that should be fixed. Also, providing that API key to this skill would grant it the ability to send arbitrary page content and templates to the external service — verify that is acceptable before supplying keys.
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. It does not declare any actions that modify other skills or system-wide configuration. Autonomous invocation is allowed by default but not combined here with any other high privilege indicators.
Scan Findings in Context
[mentions_RENDSHOT_API_KEY] expected: The reference docs and curl/SDK examples use RENDSHOT_API_KEY or a Bearer token for authentication. This is expected for a hosted rendering API, but the skill metadata does not declare this env var as required — an inconsistency to address.
[external_api_endpoint_api.rendshot.com] expected: The docs point to https://api.rendshot.com (with an option for self-hosting). Calling an external service is expected for this functionality, but it implies user data (HTML, page content, screenshots) will be transmitted externally.
[cli_sdk_install_examples] expected: Examples reference npm/pip packages and CLI auth. These are reasonable usage docs but are not part of the skill's install spec; the skill itself does not install these.
[no_metadata_env_declared] unexpected: The SKILL.md and references expect an API key, but the skill's declared required env vars are empty. This mismatch is not expected and should be corrected.
What to consider before installing
This skill appears to do what it says (render HTML to images and take screenshots), but it relies on an external Rendshot service. Before installing or enabling it: (1) Confirm where the agent will send HTML and screenshots (api.rendshot.com or a self-hosted endpoint) and review that service's privacy policy; (2) do not provide an API key to the skill unless you trust the service — supplying RENDSHOT_API_KEY would allow the skill to transmit arbitrary page content and images; (3) avoid asking the skill to screenshot internal/private URLs or sensitive pages unless you control or self-host the service; (4) ask the skill author to correct the metadata so the required RENDSHOT_API_KEY is declared in requires.env (so it’s clear what credentials are needed), and to document where keys are stored and whether the skill retains copies of rendered content; (5) if you need stricter safety, prefer a self-hosted Rendshot endpoint or a local rendering tool to avoid sending sensitive content off-host.

Like a lobster shell, security has layers — review code before you run it.

latestvk97b0s5zs7qd5pqfrzj5brjk8984t8bs
65downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Rendshot — Image Generation & Screenshot

Rendshot renders HTML/CSS to images, takes URL screenshots, and supports AI-powered template generation with platform presets.

Tool Selection

MCP tools available? Use them directly (preferred path):

ToolUse when
generate_imageRender HTML, fill a template, or AI-generate from prompt
screenshot_urlCapture a webpage
list_templatesBrowse community templates by platform/category
get_templateGet variable schema before filling a template
create_templateSave a design for reuse

No MCP tools? Fall back to CLI or API. See references/api-endpoints.md.

Core Workflows

1. AI Prompt to Image (fastest)

generate_image({
  prompt: "Coffee shop promotion card, warm brown tones, large title",
  platform: "xiaohongshu",    // auto-sets 1080x1440 + style guide
  locale: "zh"                // response language
})

Combine with template_id to reference an existing template's visual style:

generate_image({
  prompt: "Same layout but for a bakery",
  template_id: "tpl_abc123",  // style reference
  platform: "instagram_post"
})

2. Template to Image (deterministic)

// Step 1: Find a template
list_templates({ platform: "xiaohongshu", q: "product showcase" })

// Step 2: Check its variables
get_template({ template_id: "tpl_abc123" })
// Returns: title(text), subtitle(text), bg_image(image), accent_color(color)

// Step 3: Render with custom values
generate_image({
  template_id: "tpl_abc123",
  variables: {
    title: "Today's Special",
    subtitle: "Hand-roasted beans",
    bg_image: "https://example.com/beans.jpg",
    accent_color: "#8B4513"
  }
})

3. Raw HTML to Image

generate_image({
  html: "<div style='...'>Hello World</div>",
  width: 1080,
  height: 1080,
  format: "png",
  deviceScale: 2        // 2x for retina
})

4. Screenshot

screenshot_url({
  url: "https://example.com",
  width: 1280,
  height: 800,
  fullPage: true,
  format: "png"
})

5. Save and Reuse

After AI generates a design, save it as a template:

create_template({
  name: "Coffee Promo Card",
  html: "<returned html from AI>",
  variables: [
    { key: "title", type: "text", label: "Title", default: "Special Offer" },
    { key: "bg_image", type: "image", label: "Background", default: "https://..." }
  ],
  platform: "xiaohongshu",
  tags: ["coffee", "promotion"],
  visibility: "private"
})

Platform Presets

PlatformDefault sizeTypical use
xiaohongshu1080x1440Notes, product cards
xiaohongshu_wide1080x810Wide format notes
instagram_post1080x1080Feed posts
instagram_story1080x1920Stories, reels covers
twitter_card1200x628Link preview cards
twitter_post1200x675Image posts
linkedin_post1200x627Professional posts
youtube_thumb1280x720Video thumbnails
wechat_cover900x383Article covers
wechat_thumb200x200Article thumbnails
og_image1200x630Open Graph images
custom1080x1080Any custom size

Variable Types

TypeExampleConstraints
textTitle, subtitlemaxLength
imageBackground, avatarURL format
colorAccent, backgroundHex format
numberFont size, opacitymin, max
selectStyle variantoptions: ["A","B"]

Key Rules

  • html, template_id, and prompt are mutually exclusive (except prompt + template_id for style reference)
  • Always call get_template before using a template to check its variable schema
  • Use deviceScale: 2 for retina/high-DPI output
  • Default format is png; use jpg + quality: 85 for smaller file size
  • AI prompt mode returns HTML + variables; save good results with create_template
  • For detailed tool parameters, see references/mcp-tools.md
  • For API/CLI/SDK usage, see references/api-endpoints.md

Comments

Loading comments...