Vtuber Avatar Skill
v2.0.1Generate vtuber avatar creator ai images with AI via the Neta AI image generation API (free trial at neta.art/open).
⭐ 0· 183·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description promise (generate VTuber avatars via Neta AI) matches the included code and README. The script calls api.talesofai.com endpoints to request image generation and polling — this is consistent with the stated purpose. No unrelated cloud credentials or services are requested.
Instruction Scope
SKILL.md instructs the agent/user to run the included Node script with a Neta API token; the script only parses CLI args and interacts with the Neta/TalesOfAI API. It does not read arbitrary files, environment variables (other than the token passed via flag), or system paths. Note: the runtime expects the token to be passed via --token (the SKILL.md shows exporting NETA_TOKEN then invoking --token "$NETA_TOKEN").
Install Mechanism
No install spec or external downloads are included; this is effectively an instruction-only skill with an included script. No archive downloads, brew/npm installs, or execution of external installers are present.
Credentials
Only a single credential (NETA_TOKEN) is declared and required, which is appropriate for an API-based image generator. Minor inconsistency: package.json / README declare NETA_TOKEN as required, but the script does not read process.env.NETA_TOKEN directly — it expects the token to be provided via --token (the docs show passing the env var into that flag). This is a small usability mismatch, not a security red flag.
Persistence & Privilege
The skill does not request persistent or elevated platform privileges (always:false). It does not modify other skills or system-wide settings; it only runs as a normal user script when invoked.
Assessment
This skill appears to do what it says: it sends prompts and a user-provided Neta API token to api.talesofai.com and prints a returned image URL. Before installing, consider: (1) Only provide a token you trust for this service (treat it like any API key); the script sends your prompt and token to api.talesofai.com where they may be logged or used per that service's policy. (2) The code expects the token via --token; exporting NETA_TOKEN in your shell is fine if you pass it into the flag (e.g., --token "$NETA_TOKEN"). (3) Review the service's Terms/Privacy if you care about model training, retention, or image ownership. (4) Because the package author/source is unknown, prefer using a token with limited privileges or a trial token and inspect the included script (vtuberavatar.js) yourself — it is short and readable and only calls the documented API endpoints.Like a lobster shell, security has layers — review code before you run it.
latestvk97f6vhq3b1273v7y2qwxz360d83qmjb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.