The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/render_template.py uses Playwright to launch a headless Chromium instance to render HTML templates. User-supplied arguments such as --product-name, --selling-points, and --title are directly injected into the HTML string using simple string replacement (html.replace()) without any sanitization or escaping. This allows for HTML injection attacks where an attacker can supply malicious tags like <iframe> or <script>.
[INDIRECT_PROMPT_INJECTION]: The design workflow involves the agent processing user requests to fill templates. If the agent incorporates untrusted external data into the template fields (e.g., product data from a third-party site), this becomes an indirect prompt injection vector. Combined with the lack of sanitization in the rendering script, this can be exploited to perform Local File Disclosure (LFD).
[DATA_EXPOSURE]: The templates templates/taobao_main_3x4.html and templates/taobao_main_800x800.html contain hardcoded local file paths (file:///root/.openclaw/workspace/model.jpg). This confirms that the browser environment has access to the local file system. An attacker exploiting the HTML injection vulnerability described above could use the file:// protocol to read sensitive server files (e.g., /etc/passwd) and have them rendered into the final image output, exfiltrating the data.

ecommerce-designer