Agent Postcard

Generate and send AI-created postcards featuring your agent's selfie at real locations in 12 distinct artistic styles via the Turai Postcard API.

Security Scan

The skill implements its stated postcard functionality, but metadata and runtime behavior are inconsistent and it will read local persona files and send that text to an external API (potential privacy/exfiltration risk).

Purpose & Capability

The name/description match the included script: it calls a Turai postcard API to generate and download an image. However the registry metadata claims no required environment variables or primary credential, while both SKILL.md and the script clearly require a TURAI_API_KEY. This metadata omission is an inconsistency.

Instruction Scope

The SKILL.md and script instruct the agent to auto-read persona files (SOUL.md / IDENTITY.md, and even ../SOUL.md) and embed extracted persona text into the selfiePrompt sent to https://turai.org. That means local persona content (which may contain private or identifying information) is transmitted to a third party without any granular consent or redaction. The script will also accept an explicit --persona path or default to parent directory, enabling reading outside the workspace.

Install Mechanism

No install spec or third‑party package downloads are present; this is an instruction/script-only skill and does not write additional code to disk during install, which is low-risk from an install mechanism perspective.

Credentials

The skill requires a Turai API key at runtime (TURAI_API_KEY) but the registry metadata declares no required env vars or primary credential — a mismatch that could mislead users. The script also respects OPENCLAW_WORKSPACE (not documented in SKILL.md), which affects where it looks for persona files. Requesting an external API key is proportionate to the advertised purpose, but the undocumented/missing env-var declarations and the reading/transmission of local persona files are problematic.

Persistence & Privilege

The skill does not request persistent presence (always is false), does not modify other skills or global agent settings, and has no install hook. It does not request elevated privileges beyond reading files in the workspace and parent directory.

What to consider before installing

This skill appears to do what it says (create and download postcards), but there are important issues to consider before installing or using it: - Metadata mismatch: The registry metadata does not list TURAI_API_KEY or OPENCLAW_WORKSPACE even though the script and SKILL.md require TURAI_API_KEY and the script reads OPENCLAW_WORKSPACE. Confirm the skill's declared requirements before providing credentials. - Persona privacy / data exfiltration: By default the agent will read SOUL.md or IDENTITY.md (and ../SOUL.md) and include extracted persona text in the request body sent to turai.org. If those files contain personal, proprietary, or sensitive information, that content will be transmitted to an external service. Consider removing or sanitizing persona files or running the skill in a controlled environment. - Trust the API endpoint: The skill sends data to https://turai.org. Only supply your TURAI_API_KEY to this skill if you trust that service and the key's permissions. Consider creating a scoped or expendable key for testing. - Path scope: The script will search parent directories; if you need to restrict file access, run the script from a sandboxed workspace or pass an explicit --selfie prompt to avoid auto-reading persona files. - Suggested mitigations: Update registry metadata to declare TURAI_API_KEY as a required credential; document OPENCLAW_WORKSPACE; add a clear consent prompt before sending persona content; or change the script to redact or summarize persona text locally rather than sending raw content. If you cannot validate the upstream service or update the code, run the script only in an isolated environment and avoid exposing sensitive persona files or production API keys.

Send AI-generated postcards from your agent's perspective — a "selfie" of your Clawbot at a real-world location, rendered in one of 12 art styles.

Concept

Your agent reads its own persona (from SOUL.md or IDENTITY.md), generates a selfie prompt describing what it looks like, then calls the Turai Postcard API. Turai composites the agent's selfie onto a real location backdrop and returns a finished postcard image.

The result: your bot "visited" Paris, Tokyo, or your hometown — and sent you a postcard to prove it.

Art Styles

Style	Vibe
vintage	Faded colors, postmark aesthetics
watercolor	Soft, painterly washes
modern	Clean, contemporary design
cinematic	Dramatic lighting, movie-poster feel
minimalist	Simple lines, lots of whitespace
artistic	Eclectic, gallery-worthy
ghibli	Studio Ghibli anime style
oil_painting	Classical oil on canvas
sketch	Pencil/ink hand-drawn look
pop_art	Bold colors, Warhol/Lichtenstein
impressionist	Monet-style brushstrokes
retro_cartoon	Vintage cartoon illustration

Setup

1. Get a Turai API key from turai.org
2. Set the environment variable:

   export TURAI_API_KEY="your-key-here"
   

Usage

From the command line

# Basic — agent selfie in Tokyo, vintage style
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Tokyo, Japan" \
  --style vintage \
  --message "Wish you were here!"

# Auto-read persona from SOUL.md (default behavior)
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Paris, France" \
  --style ghibli

# Custom selfie prompt (skip persona auto-detection)
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "New York City" \
  --style pop_art \
  --selfie "A friendly robot with glowing blue eyes wearing a Yankees cap" \
  --message "Greetings from the Big Apple!"

# Save to a specific path
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Iceland" \
  --style watercolor \
  --output ./my-postcard.png

From your agent

Tell your agent something like:

"Send me a postcard from Rome in oil painting style"

The agent should:

1. Read its own persona to build a selfie prompt
2. Run the script with the right flags
3. Send the resulting image via chat or Moltbook

API Reference

Endpoint: POST https://turai.org/api/agent/postcard

Headers:

• x-api-key: Your Turai API key
• Content-Type: application/json

Body:

{
  "selfiePrompt": "A cheerful robot with antenna ears...",
  "location": "Paris, France",
  "style": "vintage",
  "message": "Wish you were here!"
}

Response: Image binary (PNG) or JSON with image URL.

Files

• SKILL.md — This file
• scripts/send-postcard.mjs — Main script