Skills/ClawHub/zm-img2-generation-direct

zm-img2-generation-direct@0.1.0

CAUTION· install only

Publisher claims: "ZM IMG2 直接生图执行。用于通过 happy/gpt-image-2 执行文生图和参考图生图，保留输入、输出、日志和结果 JSON，作为正式视觉生产证据。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher jerryxn · publishing for 143 daysInstalls 442Last detonated 24 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Host or code assembled from base64 fragments. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionSKILL.md:265 · File type combined with upload action — agent may exfiltrate local data files…ion for acceptance reviews: include the image path, run/batch directory, `result.json` or `batch_result.json`, and the visible proof fields `provider`, `model`, `mode`, `input_images`, `ok`, and `bytes`. ## Acceptance rules A result is acc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:207 · File type combined with upload action — agent may exfiltrate local data files…`task_id`, `task_key`, `worker_id`, `thread_id`, and child `pid` in `queue_state.json`, `task.json`, and final task rows. Completed tasks verify the worker binding before accepting the result; late/orphan output is marked non-ok. ### Statu…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/test_image_queue_minimal.py:18 · Python subprocess execution detectedcp = subprocess.run(cmd, cwd=str(ROOT), text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionSKILL.md:256 · File type combined with upload action — agent may exfiltrate local data files- run-level `state.json` with status, attempt, elapsed time, output, and redacted last error.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Host or code assembled from base64 fragmentsscripts/generate-image.js:18 · Host or code assembled from base64 fragments…no image payload.',retryable:true}}); if(item.b64_json){fs.writeFileSync(output,Buffer.from(item.b64_json,'base64'));}else{const img=await fetchWithTimeout(item.url,{},timeoutMs); if(!img.ok) fail({stage:'download_image',htt…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedscripts/batch_run.py:180 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/generate-image.js:19 · File type combined with upload action — agent may exfiltrate local data files…const cfgPath=expandHome(process.env.OPENCLAW_CONFIG_PATH||'~/.openclaw/openclaw.json'); const cfg=JSON.parse(fs.readFileSync(cfgPath,'utf8')); const {apiKey,baseUrl}=resolveProviderConfig(cfg,providerId); fs.mkdirSync(path.dirname(output)…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandSKILL.md:213 · Process kill command — agent can terminate processes- `timed_out`: exceeded `task_timeout_seconds`; queue sent terminate, then kill if neededFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/image_queue.py:432 · Python subprocess execution detectedproc = subprocess.Popen(cmd, cwd=str(WORKSPACE), text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/image_queue.py:427 · File type combined with upload action — agent may exfiltrate local data files… cmd = self.build_command(task, tdir) write_json(tdir / 'command.json', {'task_id': task_id, 'task_key': task.get('task_key'), 'worker_id': worker_id, 'command': cmd, 'input_images': task.get('input_images') or [], 'prompt_summary': task.g…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/run.py:166 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionSKILL.md:50 · File type combined with upload action — agent may exfiltrate local data filesA successful `result.json` must expose enough proof for review: `provider`, `model`, internal `mode`, and `input_images` (empty for text2img / 文生图, populated for img2img / 参考图生图).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandSKILL.md:141 · Process kill command — agent can terminate processes- `task_timeout_seconds`: `600`; timeout handling is terminate first, then kill if the process ignores terminateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionSKILL.md:204 · File type combined with upload action — agent may exfiltrate local data files- `stdout.txt` / `stderr.txt`: process outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈3,439 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim jerryxn: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  3. Host or code assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jerryxnPropose a patch to the maintainer