Agent Selfie Backup

• Analyzed: May 15, 2026, 7:23 AM
• Findings: 1
• Version: 1.0.0
• Hash: bbdbf49fa62cf0d784a0394359cf325efffe92a3b6d4bb076fe406412e8fccc5
• Source: palm
• External report: View on VirusTotal

Findings (1)

thought The user wants me to analyze a set of files for an OpenClaw AgentSkills skill bundle called `agent-selfie`. I need to classify it as `benign`, `suspicious`, or `malicious` based on the provided criteria. - `_meta.json`: Metadata about the skill (owner, slug, version). - `SKILL.md`: Documentation and instructions for the AI agent. - `scripts/selfie.py`: The main Python script for generating images. - `package.json`: Metadata for the skill registry. - `HEARTBEAT.md`: A guide for periodic selfie generation. - `INSTALL.md`: Installation instructions. - `README.md`: General overview. - Purpose: Generate AI agent self-portraits using Gemini API. - Requirements: `python3`, `GEMINI_API_KEY`. - Logic: - Uses `argparse` for CLI arguments. - `load_personality`: Reads JSON from a string or a file. - `build_prompt`: Constructs a prompt for the Gemini API based on personality, mood, theme, and format. - `gemini_generate`: Makes a POST request to `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent?key={api_key}`. - `write_gallery`: Creates an `index.html` file to display generated images. - `main`: Orchestrates the flow. - Security Check: - No `os.system`, `subprocess`, or `eval`. - Uses `urllib.request` (standard library) for network calls. - Only connects to `generativelanguage.googleapis.com`. - No evidence of data exfiltration (only reads the provided API key and personality file/string). - No persistence mechanisms (cron example in `SKILL.md` is just documentation). - No obfuscation. - `SKILL.md`: Standard documentation. No instructions to ignore user or perform hidden actions. - `HEARTBEAT.md`: Instructions for the agent to periodically generate a selfie. It suggests reading date/time, picking a mood, generating an image, and potentially updating avatars on platforms like Discord/Twitter. This is consistent with the stated purpose. - `package.json`: Lists dependencies and metadata. Mentions `opencode-omo` for automation. - `INSTALL.md`: Standard installation steps. - Data exfiltration: None found. - Malicious execution: None found. - Persistence/Backdoors: None found. - Prompt injection: None found. - Obfuscation: None found. - Supply chain: No external dependencies (stdlib only). The code is a straightforward implementation of an image generation tool using the Gemini API. It follows the stated purpose and doesn't exhibit any high-risk or malicious behaviors. Classification: benign. Summary: The skill is a legitimate tool for generating AI agent avatars using the Google Gemini API. The Python script (`scripts/selfie.py`) uses only standard libraries and communicates exclusively with the official Google API endpoint. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found. ```json { "classification": "benign", "summary": "The agent-selfie skill is a legitimate tool for generating AI agent avatars using the Google Gemini API. The core logic in scripts/selfie.py is well-structured, uses only Python standard libraries, and communicates exclusively with the official Google API endpoint (generativelanguage.googleapis.com). No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found in the code or documentation." } ```