Clawy
v0.2.9Bring your agent to life. Generate stable agent avatars and short image-driven adventure arcs. Use when creating or refining a mascot/agent identity, preserv...
⭐ 1· 377·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (avatar + adventure image edits) match the actual behavior: the script calls image-edit endpoints (WaveSpeed, OpenAI, Gemini/Nano, Ark) and requires the corresponding API keys. There are no unrelated credentials or system paths requested.
Instruction Scope
SKILL.md restricts uploads to selected reference images only and documents that the helper script may download and write the bundled 'mother' image. The runtime script indeed uploads the mother/reference image to the chosen provider when generation is invoked. This behavior is coherent with the stated purpose but does involve network upload of image data (expected for image-edit workflows).
Install Mechanism
No install spec — instruction-only with a bundled helper script. Nothing is downloaded from package registries or installed automatically; risk from install mechanism is low.
Credentials
Declared ONE_OF API keys (WAVESPEED_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, NANO_API_KEY, ARK_API_KEY) match the backends the script supports. Optional overrides (OPENAI_BASE_URL, NANO_BASE_URL, etc.) are documented and used by the script; no unrelated secrets requested.
Persistence & Privilege
always:false and default autonomous invocation are normal. The skill may write the mother image into assets/default-mother-image.png (self-contained asset use), but it does not request persistent system-wide privileges or modify other skills.
Assessment
This skill appears coherent: it needs an image-edit provider API key and will upload reference/mother images to that provider to produce edits. Things to consider before installing:
- Only provide API keys for providers you trust; uploaded reference images (including any private pictures you choose to use) will be sent to the chosen provider and may be stored according to that provider’s policy.
- The script may download a fallback mother image from https://www.8uddy.land/images/clawy.png if the bundled asset is missing — if you prefer not to fetch from that external domain, ensure assets/default-mother-image.png exists locally beforehand.
- The helper uses curl subprocess calls to interact with provider APIs (expected for this task). If you need stricter network controls, run in an environment that restricts outbound access or review the script locally before use.
- If you want to be extra cautious, inspect the full script file (scripts/generate_avatar.py) and verify any base URL overrides before supplying non-standard endpoint environment variables.
Overall, the skill is internally consistent with its stated purpose, but be mindful of image uploads and the fallback download URL.Like a lobster shell, security has layers — review code before you run it.
latestvk979kfkmf8kc8yqbw2adqvsm1583ezgm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvONE_OF:WAVESPEED_API_KEY|OPENAI_API_KEY|GEMINI_API_KEY|NANO_API_KEY|ARK_API_KEY
