aavegotchi-sprites-generator
v0.1.1Generate official-style Aavegotchi game sprites and animated GIFs with the upstream gotchi-generator package. Use when the user wants sprite-sheet style outp...
⭐ 0· 56·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included scripts and package.json. The skill only requires Node.js and image libraries (gotchi-generator, gifenc, sharp-related optional packages) which are appropriate for rendering sprites and GIFs.
Instruction Scope
SKILL.md instructs running the included node/bash scripts and documents inputs/outputs. Runtime behavior is limited to reading local input JSON, local reference files, invoking the upstream gotchi-generator library, producing image/GIF outputs, and printing a manifest/helper variables for chat delivery. The instructions do not ask for unrelated files, secrets, or external endpoints.
Install Mechanism
No formal install spec is provided in the registry metadata (the package is instruction-/code-based), but package.json and package-lock.json are included indicating npm dependencies. Installing requires running npm install on the host; dependencies come from the npm registry (traceable). Be aware image tool dependencies (sharp / libvips) pull native binaries and optional packages which can increase install complexity and require build/runtime support.
Credentials
The skill declares no required environment variables, no credentials, and the scripts do not read secrets or external config paths. All environment access is proportional to the task (filesystem I/O and node process environment).
Persistence & Privilege
always:false and user-invocable. The skill does not request persistent system-wide privileges, does not modify other skills, and confines outputs to its own folders. Autonomous invocation is allowed by platform default but is not combined with other red flags.
Assessment
This skill appears to be what it says: a Node.js wrapper around the upstream gotchi-generator to produce sprite PNGs and GIFs. Before installing or running it, consider: 1) Run npm install in an isolated environment (or review packages) because dependencies pull native/image libraries (sharp/libvips) that may require extra build/runtime libraries. 2) Review the included package-lock.json and the upstream gotchi-generator repo (trust the source) if you need higher assurance. 3) If you run this in a multi-tenant or production environment, run in a sandbox/container since the scripts use filesystem I/O and execute Node code. 4) The skill requires no secrets, but if you enable autonomous invocation for this skill, limit its permissions to avoid unexpected automated runs. 5) If your platform does not automatically run npm install, the skill will fail until dependencies are installed.Like a lobster shell, security has layers — review code before you run it.
latestvk97dkr7aq4x7jsr8656rgt7c3184wxpx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.