favicon-so
v1.0.0favicon.so project API reference — covers the favicon fetch API and image-to-favicon-package convert API. Use when working on API routes, building integratio...
⭐ 0· 194·0 current·0 all-time
byYiChu@go7hic
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the SKILL.md content: it documents favicon fetch and image-convert APIs, implementation files, and libraries (jimp, jszip). Nothing requested (env vars, binaries, or installs) is out of scope for an API reference.
Instruction Scope
SKILL.md is documentation-style: it describes endpoints, parameters, response formats, and where implementation lives in the repo. It does not instruct the agent to read unrelated system files, access credentials, or send data to external endpoints beyond the documented API behavior. The file paths referenced (app/api/..., lib/...) are appropriate for someone working on that project.
Install Mechanism
No install spec is provided (instruction-only), so nothing will be downloaded or written to disk by the skill itself. Libraries are mentioned for context but no installation commands are included.
Credentials
The skill requests no environment variables, credentials, or config paths. That aligns with a public API reference which explicitly states the server APIs are unauthenticated (CORS enabled, no auth required).
Persistence & Privilege
always:false and default invocation settings are present. The skill does not request persistent system presence or modify other skills/config; nothing in the documentation grants elevated privileges.
Assessment
This is a documentation-only skill describing favicon fetch and convert APIs — it does not ask for secrets or install code. You can safely use it to get API shapes and implementation pointers. Consider: if you allow an agent access to your repository or to execute commands, review any code changes before applying them; if you run or install dependencies (jimp, jszip) in your environment, install from official package registries and verify versions. Also note the convert API is unauthenticated and CORS-enabled, so verify that behavior matches your security requirements before exposing sensitive inputs.Like a lobster shell, security has layers — review code before you run it.
latestvk970nts444njyh0w3amynakgws82r19m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.