ClawHub

Wallhaven Downloader

v0.1.3

Download wallpapers in batch from wallhaven.cc via API v1 with flexible query parameters (q, categories, purity, sorting, order, topRange, atleast, resolutio...

⭐ 1· 327·0 current·0 all-time
byjingyuan@jingyuan9527
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match required env var and behavior: the script downloads wallpapers from wallhaven.cc using the Wallhaven API and optionally an API key for NSFW/private results. No unrelated credentials, binaries, or config paths are requested.
✓
Instruction Scope
SKILL.md and the script stay within the stated purpose: they build API queries, paginate, validate image URLs, download images, and write a manifest. The instructions do not tell the agent to read other files or exfiltrate unrelated data. The script validates hosts and blocks non-HTTPS and private/local addresses.
✓
Install Mechanism
There is no install spec (instruction-only skill) and the included Python script is self-contained. The script uses subprocess calls to curl to perform HTTP requests rather than embedding an HTTP library; this is normal and proportionate for the task.
✓
Credentials
Only WALLHAVEN_API_KEY is declared/used, which is appropriate because the API key is required for NSFW/private queries. The SKILL.md warns against hardcoding keys and the script reads the key only from the --apikey parameter or WALLHAVEN_API_KEY.
✓
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. It writes output only to the user-specified output directory and a manifest there.
Assessment
This skill appears to do exactly what it claims. Before installing, confirm you trust the publisher and accept that the script will: (1) make network requests to wallhaven.cc and w.wallhaven.cc, (2) spawn curl processes, and (3) write image files and manifest.json to the output directory you provide. Do not pass secrets other than your Wallhaven API key, and avoid using a key if you do not want to retrieve NSFW/private content. Because the script runs locally and is included in the package, you can inspect the provided scripts (they are included) before running. If you want extra assurance, run the script in an isolated environment or review the subprocess usage (it calls curl via a safe list-style invocation, not shell execution).

Like a lobster shell, security has layers — review code before you run it.

latestvk9707px6anefg4gdmsvj3e8gv18271qc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvWALLHAVEN_API_KEY

Comments