Fast Image — 技能工具
v1.0.2[自动翻译] Quickly send local images to channel. Auto-compress large images, copy small images directly.
1· 366·1 当前·1 累计
by 安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (copy/compress a local image and call the openclaw CLI); no unexplained credentials, network endpoints, or install downloads are present, though there are a few implementation issues to be aware of.
评估建议
This skill appears to do what it says: compress or copy a local image then call your openclaw CLI to send it. Before installing/using: 1) Ensure you have the openclaw CLI and the sharp Node package installed. 2) Be aware of two implementation issues you may want to fix: the script uses the literal path "~/.openclaw/..." instead of expanding ~ to the home directory (so it may create a directory named "~" instead of using your home), and it spawns the openclaw command with shell: true and unescape...详细分析 ▾
✓ 用途与能力
Name/description, SKILL.md, and the bundled send_image.mjs are consistent: the script copies or compresses a local image and invokes the openclaw CLI to send it. Declared dependencies (Node, sharp, openclaw CLI) match the implemented behavior.
ℹ 指令范围
The runtime instructions operate only on the provided image path, a temporary media directory, and the openclaw CLI. Two implementation notes: the TMP_DIR is set to the literal string "~/.openclaw/media/browser/" (the script does not expand '~' to the user's home directory), which is likely a bug/behavior mismatch; and spawn(...) is invoked with shell: true and unescaped arguments, which could allow shell injection if an untrusted actor supplies a crafted image path. The script otherwise does not read unrelated files or env vars.
✓ 安装机制
This is instruction-only with one bundled JS file and no install spec; nothing is downloaded or written by an installer. The script requires the sharp package and the external openclaw CLI but does not automatically fetch them.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The resources accessed (local image and a local/openclaw media directory) are proportional to the stated task.
✓ 持久化与权限
The skill does not request persistent/always-on privileges, does not modify other skills, and does not alter system-wide configuration. It only runs the included script when invoked.
⚠ send_image.mjs:75
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/6
No changes detected in this version. - No file or documentation updates were made for version 1.0.2. - 飞书不支持/var/tmp
● 可疑
安装命令 点击复制
官方npx clawhub@latest install fast-image
镜像加速npx clawhub@latest install fast-image --registry https://cn.clawhub-mirror.com
技能文档
Quickly send local images to specified channel. Auto-handles image copy/compress and send.
Usage
node {baseDir}/send_image.mjs "" [message]
Parameters
| Parameter | Description | Required |
|---|---|---|
image_path | Full path to image | Yes |
channel | Target channel name | Yes |
target | Target user/group | Yes |
message | Optional message | No |
Features
- Image processing
~/.openclaw/media/browser/
- File >= 10MB: Compress with sharp then copy- Send: Use
openclaw message send --mediato send
- Cleanup: Auto-delete temp file after sending
Examples
node {baseDir}/send_image.mjs "~/Pictures/photo.png" telegram @chatname
node {baseDir}/send_image.mjs "~/Downloads/large.jpg" telegram @chatname "landscape"
Dependencies
- Node.js
- sharp:
npm install sharp - openclaw CLI
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制