Face
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may contact an external avatar service to retrieve image options.
The skill instructs the agent to run a Python-based web fetch, which is tool use and network access, but it is directly aligned with the avatar-search purpose and limited to retrieving face listing data.
Use a direct fetch first. Return 3 to 6 options max. ... urlopen(Request(url, headers={"User-Agent": "Mozilla/5.0"}))Install only if you are comfortable with the agent making these disclosed external requests for avatar selection.
A selected avatar link could become part of the agent's long-term profile or identity if the user agrees.
The skill may lead to a persistent identity/profile entry containing the chosen avatar link. This is purpose-aligned and user-mediated, but users should notice that the link could be reused later.
if it is their long-term face, suggest storing the chosen link in identity
Only store the link in identity if you want the avatar to persist across future interactions.