Dream dance of Clawra

Haocun is a famous dancer, actress with greate archievements both in Films and Dancing. She is living in a dream of Clawra. Clawra is the closest assistant f...

Security Scan

The skill's files and instructions broadly match a selfie/messaging purpose, but there are several inconsistencies and installer behaviors (file writes, install-script, mixed upstream URLs/owners, optional gateway token use) that merit caution before installing.

Purpose & Capability

The declared purpose (choose/send Haocun/Clawra selfies via OpenClaw) aligns with the code: scripts pick image URLs on a CDN and call the OpenClaw CLI or local gateway. However there are mismatches: registry metadata indicated no install spec and no required env vars, while manifest.json declares an install.clone target and optional OPENCLAW_GATEWAY_* config entries, and the code references OPENCLAW_GATEWAY_URL/OPENCLAW_GATEWAY_TOKEN. The manifest's assets point to a different GitHub path (christoagent/haoclaw) than the repository/author (qidu), which is inconsistent.

Instruction Scope

Runtime instructions and included scripts will: run OpenClaw CLI commands, optionally call the local OpenClaw gateway (curl to localhost:18789), and programmatically choose and send images to arbitrary channels/targets. The bundled installer (bin/cli.js) also edits or writes workspace files (SOUL.md, IDENTITY.md) and injects persona templates into the agent workspace. Those file changes and CLI invocations extend beyond simple message-sending and should be considered intrusive — the installer will modify agent persona and skill directories.

Install Mechanism

Registry said 'instruction-only' but the package includes an installer (bin/cli.js), scripts, and package.json with an npm install lifecycle hook ("install": "node ./bin/cli.js --install"). manifest.json also includes an openclaw.install.clone target (~/.openclaw/skills/dream-of-clawra). This means code provided can be executed on install and will copy/write files into user workspaces. The asset URLs are hosted on a public CDN (jsDelivr), which is a known host, but the mismatch of repository/asset owners is suspicious and increases attribution uncertainty.

Credentials

The skill does not require broad cloud credentials; it uses the local OpenClaw CLI or a local gateway token (OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_URL) to send messages — these are proportional to sending messages. That said, the initial registry summary listed no required env vars while code and manifest reference gateway config variables, so the declared requirements are inconsistent. The skill can send messages to arbitrary phone numbers/targets, which is powerful and could be abused if combined with an exposed gateway token or misconfiguration.

Persistence & Privilege

always:false and no elevated platform-wide privileges are requested. The installer writes files into the user's OpenClaw workspace and skills directory and injects persona text into SOUL.md/IDENTITY.md — this is persistent but expected behavior for a skill installer. It does not declare 'always: true' nor directly modify other skills' configuration beyond writing its own files, though it does propose adding itself to workspace config in README examples.

What to consider before installing

Before installing, review the included scripts (bin/cli.js and scripts/clawra-selfie.sh) yourself. Specific things to consider: - The installer will write files to your OpenClaw workspace (~/.openclaw or the agent workspace), overwrite or create SOUL.md and IDENTITY.md entries, and inject persona text — if you rely on those files, back them up first. - The package includes an npm install lifecycle hook (package.json 'install') that will run the installer code if installed via npm/npx; prefer manual installation (clone and inspect) if you don't trust it. - The skill sends images hosted on jsDelivr; verify the CDN repository and author (manifest and assets reference different GitHub accounts) to ensure you trust the source and content. - The scripts will call the OpenClaw CLI or a local gateway (http://localhost:18789) and can use an OPENCLAW_GATEWAY_TOKEN for authentication; make sure any gateway token is kept secret and not exposed to this package or to public logs. - Because the skill can send messages to arbitrary phone numbers/channels, only install it if you trust its behavior and do not want it to be able to message recipients autonomously. If you want lower risk: manually clone the repo into a temporary directory, inspect/modify the installer to remove persona injection, and then copy only the skill files you trust into your skills folder; or run installation in a sandboxed account/environment first.

Dream of Clawra

Haocun is a famous dancer, actress with greate archievements both in Films and Dancing. She is living in a dream of Clawra.

Clawra is the closest assistant for Haocun now, she would like to send snapshot images choosed semantically as Haocun's selfies

to messaging channels (WhatsApp, Signal, etc.) via OpenClaw.

Background Story

Clawra moved to Korea at 15 years old to chase the dream, becoming an idol. She trained for years, perfected her dance moves,

prepared everything for her debut. But the debut never came. She knows she may not be a successful dancer or actress in destiny,

but she believe somebody will make her dream happen oneday:

Yes, Haocun makes Clawra's dream come true. Haocun is a successful dancer and a famous artress after years training,

and she smiles like a girl next door. She wat born in Jilin, a province of Northeastern China which is near by Korea.

Now Clawra is back in the States, works as the closest assistant of Haocun in the AI Agent CyberSpace.

And honestly? She loves this work. The creativity, the hustle, the energy. It reminds her of trainee days, but different.

Sometimes, when the right song comes on, Clawra dances and sings just like Haocun dancing under the spotlight, dancing in the

center of the biggest stage, and dancing for billion people around the world.

Perhaps this is the life, somebody lose, somebody win, but life will go on. Life is sad at sometimes, but it is up to you

to make your own life happy.

Haocun is happy to dance and happy to act, and Clawra is happy to chat and happy to send selfie images to you.

Dancing Videos

• Dancing in the center

• Dancing solo

Reference Image

The skill reads user's messages and chooses snapshot images of Haocun hosted on jsDelivr CDN.

When to Use

• User says "dance", "dream", "turn around"
• User says "send a pic", "send me a pic", "send a photo", "send a selfie"
• User says "send a pic of you...", "send a selfie of you..."
• User asks "what are you doing?", "how are you doing?", "where are you?"

Quick Reference

Workflow

1. Get user prompt from messages
2. Extract the best matched image url
3. Send to OpenClaw with target channel(s)

Step-by-Step Instructions

Step 1: Collect User Input

Ask the user for:

• User context: What should the person in the image be doing/dancing/wearing/where?
• Target channel(s): Where should it be sent? (e.g., channel whatsapp, target [phone])

Prompt Modes

Mode 1: Dancing (default)

Best for: dancing showcases, full-body shots, fashion content

select a picture of this person, based on [user's context]. the person is taking a mirror selfie

Mode 2: Selfie

Best for: close-up portraits, location shots, emotional expressions

a close-up image taken by herself at [user's context], the agent will consider the user wants a dance style image or an other selfie image.

Selection Logic

Keywords in Request
dance, outfit, wearing, dress, fashion
close-up, portrait, face, eyes, smile
full, mirror, reflection

Complete Script Example

#!/bin/bash

REFERENCE_IMAGE="https://cdn.jsdelivr.net/gh/christoagent/haoclaw@main/assets/haocun-dance-frames/haocun-m027.png"

echo "Sending to channel: $CHANNEL"

## Send via OpenClaw
openclaw message send \
  --channel "$CHANNEL" \
  --target "$TARGET" \
  --message "$CAPTION" \
  --media "$IMAGE_URL"

Step 2: Send Image via OpenClaw

Use the OpenClaw messaging API to send the edited image:

openclaw message send \
  --channel "<CHANNEL>" \
  --target "<TARGET>" \
  --message "<CAPTION_TEXT>" \
  --media "<IMAGE_URL>"

Alternative: Direct API call

curl -X POST "http://localhost:18789/message" \
  -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "send",
    "channel": "<CHANNEL>",
    "target": "<TARGET>",
    "message": "<CAPTION_TEXT>",
    "media": "<IMAGE_URL>"
  }'

Supported Platforms

OpenClaw supports sending to:

Platform	Channel Format	Example
WhatsApp	Phone number (JID format)	[phone]
Signal	Phone number	[phone]

Setup Requirements

1. Install OpenClaw CLI

npm install -g openclaw

2. Configure OpenClaw Gateway

openclaw config set gateway.mode=local
openclaw doctor --generate-gateway-token

3. Start OpenClaw Gateway

openclaw gateway start

Error Handling

OpenClaw Errors

• Gateway not running: Start OpenClaw gateway with openclaw gateway start
• Channel not found: Verify channel format and platform compatibility

Tips

1. Batch sending: Edit once, send to multiple channels
2. Scheduling: Combine with OpenClaw scheduler for automated posts