Ellya--Your Virtual Companion

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its virtual-companion image-generation purpose, but it may store very detailed personal photo traits and includes an overbroad command that could accidentally send older generated images.

Install only if you are comfortable with selected photos being processed by Gemini and stored locally for reuse. Review and periodically delete assets/base.*, styles/*.md, output images, SOUL.md, and any memory files if they contain personal information. Avoid the README's broad output/series_* send loop; use only the exact newly generated file paths.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Uploaded photos may be analyzed and saved as reusable style notes containing detailed body, skin, or identifying characteristics.

Why it was flagged

The image-analysis prompt directs extraction of sensitive body and identifying-marker details from uploaded photos; the skill also stores learned style outputs for reuse, so this can persist more personal detail than users may expect from 'style learning.'

Skill content
**Skin and Marks**: Skin tone under tension, muscle line shadows, precise mole locations, faint veins, tattoo details.
Recommendation

Limit analysis to clothing, scene, lighting, and aesthetic style; clearly disclose what is stored, where it is stored, and how users can review or delete it.

ConcernMedium Confidence
ASI02: Tool Misuse and Exploitation
What this means

A later photo-series request could accidentally send older generated images to the current chat or target.

Why it was flagged

This loop can match images from every prior series directory, not just the current request's output, before sending them through OpenClaw.

Skill content
for image in output/series_*/0*.png; do
    openclaw message send --channel <channel> --target <target> --media "$image"
done
Recommendation

Send only the exact file paths printed by the most recent generation command, or restrict the loop to the specific newly created series directory and confirm before bulk sending.

What this means

The skill will use the user's Gemini account quota/billing and send selected image inputs to Google's GenAI service.

Why it was flagged

The script uses a Gemini API key, which is expected for Gemini image analysis/generation; no hardcoded key or credential logging is shown in the provided code.

Skill content
api_key = os.environ.get("GEMINI_API_KEY")
Recommendation

Use a dedicated Gemini API key if possible, monitor usage, and only provide images you are comfortable processing with that provider.

What this means

The skill may not run until dependencies are installed, and users must trust the local Python dependency setup.

Why it was flagged

The registry presents the skill as instruction-only with no declared required binaries or environment variables, while the README expects dependency installation and an API key.

Skill content
# Install dependencies
uv sync

# Set API key
export GEMINI_API_KEY="your-api-key"
Recommendation

Verify the dependency files/source before running uv commands, and update metadata to declare uv/Python and GEMINI_API_KEY requirements.