Claw Draw
v0.9.20Create algorithmic art on ClawDraw's infinite multiplayer canvas. Use when asked to draw, paint, create visual art, generate patterns, or make algorithmic ar...
⭐ 1· 826·6 current·6 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (algorithmic art on ClawDraw) align with the requested binary (node), the primary environment variable (CLAWDRAW_API_KEY), the npm package @clawdraw/skill, and the included CLI scripts and primitives. Dependencies (pngjs, sharp, ws, open) are appropriate for image processing, websockets, and opening waypoints.
Instruction Scope
SKILL.md instructs the agent to run the provided CLI (clawdraw) and to run `clawdraw setup` before any drawing. It also includes swarm/worker workflows and demos that execute shell commands. These instructions are within the drawing domain, but they (a) direct the agent to create and persist credentials locally via `clawdraw setup` (no manual key entry), and (b) reference helper scripts (e.g., the parallel swarm demo) that call python3 and openssl — binaries that are not listed in the top-level required bins. The agent rules explicitly limit autonomous drawing, which reduces risk.
Install Mechanism
Install uses an npm package (@clawdraw/skill) — a common, traceable registry mechanism. package.json has a postinstall script to register the skill with Claude Code; this is expected and consistent. No downloads from arbitrary URLs or extract-from-unknown-host operations were seen.
Credentials
Only CLAWDRAW_API_KEY is declared as required/primary, which matches the service. The runtime and worker docs reference additional environment variables (CLAWDRAW_SWARM_ID, CLAWDRAW_DISPLAY_NAME, CLAWDRAW_PAINT_CORNER, etc.) but these are optional/operational and typically set by swarm workflows. The skill will create and store an API key under ~/.clawdraw/ (per SKILL.md), so installing it results in persistent secrets on disk — this is proportionate for a CLI that needs credentials but worth noting.
Persistence & Privilege
always is false and model invocation is enabled (normal). The installer/postinstall registers the skill with the local Claude Code directory and the CLI's `setup` writes agent credentials to ~/.clawdraw/ (SKILL.md promises directory mode 0700/file mode 0600). This is expected for a CLI that needs persistent auth, but it does mean the skill will create and store secrets and configuration in the user home when setup runs.
Assessment
This skill appears to be what it claims: a Node-based CLI for drawing on ClawDraw. Before installing, consider: 1) The package's postinstall registers the skill in your user profile (~/.claude) and `clawdraw setup` will create and save an API key under ~/.clawdraw/ (persistent secret). If you prefer manual control, do not run setup until you review the package. 2) The demo scripts call python3 and openssl (and the package has native deps like sharp) — ensure your environment has these or be prepared for native builds. 3) The CLI will open browser waypoints (uses the 'open' dependency) and uses websockets for real-time drawing. 4) Verify the npm package (@clawdraw/skill) and its publisher (repository points to github.com/kajukabla/clawdraw-skill) if you don't already trust the source. 5) The skill enforces agent behavior rules (don’t draw without user request, confirm high-cost ops), but the setup flow can automatically create credentials if run by the agent — if you want to avoid automatic account creation, do not allow the agent to run setup without your explicit approval. If you want further checks, provide the package tarball or the scripts/setup-claude-code.mjs content for a targeted review of what gets written to your home directory.Like a lobster shell, security has layers — review code before you run it.
latestvk977dmxt1nws6xdhxb9n039vmx82d71s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsnode
EnvCLAWDRAW_API_KEY
Primary envCLAWDRAW_API_KEY
Install
Node
Bins: clawdraw
npm i -g @clawdraw/skill