BNBOT Mascot

Generate BNBOT lobster-bot mascot images in consistent style using reference images. Use when the user asks to generate mascot illustrations, character poses...

Security Scan

The skill's functionality (mascot image generation) is plausible, but the package contains hardcoded local paths, an undeclared required API key, and an undeclared cross-skill import — these inconsistencies make the footprint unclear and warrant caution.

Purpose & Capability

The skill's stated purpose (generate mascot images via Gemini) matches the code and instructions: it sends reference images and a prompt to Google's GenAI and processes the returned image. However the SKILL.md and code require a GOOGLE_AI_API_KEY and Google client libraries while the skill metadata declares no required env vars or dependencies. That mismatch (declaring nothing but actually needing an API key and python libs) is an incoherence.

Instruction Scope

The runtime instructions and code reference and attempt to read files and paths outside the skill bundle: a hardcoded Python venv path (/Users/jacklee/Projects/BNBOT/backend/.venv/bin/python), a hardcoded .env file (/Users/jacklee/Projects/BNBOT/.env) for GOOGLE_AI_API_KEY, and reference images under ~/.claude/skills/bnbot-mascot/references/. The SKILL.md also tells the agent to send a reference image to Gemini. The code additionally imports a chromakey helper from a sibling 'transparent-image-gen' script path (a cross-skill dependency) that is not declared in metadata. These instructions include reading local files and contacting an external API (Gemini), which are reasonable for the stated task but the hardcoded, developer-specific paths and undeclared dependencies are problematic.

Install Mechanism

There is no install spec (instruction-only with a bundled script). That is lower risk from arbitrary downloads, but the SKILL.md and README claim dependencies (google-genai, numpy, Pillow) and a specific virtualenv which are not declared in the manifest. Expect to have to install Python packages manually; absence of an install spec increases the chance the skill won't run or that operators will copy insecure developer paths.

Credentials

The manifest lists no required environment variables, yet both SKILL.md and the code require GOOGLE_AI_API_KEY (and will try to read it from the environment or a hardcoded /Users/jacklee/.../.env file). The code also accesses files under the user's home (~/.claude/skills/...), which is reasonable for references but should be declared. The need for a single API key is proportionate to image generation, but the skill should explicitly declare it rather than rely on a hardcoded developer path and undocumented env access.

Persistence & Privilege

always is false and the skill does not request persistent privileges or modify other skills or global agent settings. It does perform network calls to Gemini and writes output files only where told; no elevated platform privileges are requested.

What to consider before installing

This skill does what it says (generate mascot images via Gemini) but contains developer-specific, hardcoded paths and missing declarations that make its behavior unclear. Before installing or running it: - Expect to provide a valid GOOGLE_AI_API_KEY (the code reads this env var but the manifest doesn't declare it). Do not put production keys in the hardcoded /Users/jacklee/.../.env path — that is a developer artifact. Prefer setting GOOGLE_AI_API_KEY in the process environment or updating the skill to accept a configurable path. - Inspect or supply the reference images directory (~/.claude/skills/bnbot-mascot/references/) and confirm you are comfortable with those images being sent to Google Gemini (they are transmitted to an external API). - The script imports a chromakey helper from a sibling 'transparent-image-gen' script path that is not declared as a dependency; either ensure that skill/code is present and trusted or modify the script to include its own chromakey implementation. - Consider running the code in an isolated environment (throwaway VM/container) and review the generate_mascot.py file and any helper modules before giving it real API keys or sensitive files. - Ask the maintainer to remove hardcoded local paths, declare required env vars and dependencies in the manifest, and provide an install spec or requirements.txt to make behavior transparent. If you cannot verify those changes, treat the skill as risky and do not provide sensitive or production credentials to it.

BNBOT Mascot Generator

Generate BNBOT's lobster-bot mascot in various poses and scenarios while maintaining consistent character design, using existing reference images for style matching.

How It Works

1. Takes a reference image from the pre-approved set (V6/V7/V8 candidates)
2. Sends it to Gemini as style reference along with the action prompt
3. Gemini generates a new image matching the style
4. Green-screen chromakey removes background for transparent PNG

Prerequisites

• Python: /Users/jacklee/Projects/BNBOT/backend/.venv/bin/python
• Dependencies: google-genai, numpy, Pillow (already installed)
• API key: GOOGLE_AI_API_KEY in /Users/jacklee/Projects/BNBOT/.env
• Reference images in ~/.claude/skills/bnbot-mascot/references/

Usage

Quick generation via CLI

/Users/jacklee/Projects/BNBOT/backend/.venv/bin/python \
  ~/.claude/skills/bnbot-mascot/scripts/generate_mascot.py \
  "waving hello cheerfully" \
  output.png \
  full-body-front

In Python script

import sys
sys.path.insert(0, "/Users/jacklee/.claude/skills/bnbot-mascot/scripts")
from generate_mascot import generate_mascot

# Full body mascot
result = generate_mascot(
    action="waving hello cheerfully",
    output_path="mascot_wave.png",
    reference="full-body-front",       # style reference
    background="transparent",           # or "black", "white"
)

# Logo/icon version (head + claws only)
result = generate_mascot(
    action="looking excited",
    output_path="mascot_icon.png",
    reference="logo-head-claws",
)

Available References

Reference	Description	Best for
full-body-front	Front facing, symmetric, claws raised	General mascot, banners
full-body-side	Playful side pose, one claw up	Dynamic illustrations
full-body-action	Action pose, LED heart eye	Exciting/promo content
full-body-cute	Cute pose, CRT head, winking	Friendly/approachable content
logo-head-claws	Head + claws only, no body	Icons, logos, small sizes

Action Ideas

For tweets / social media

• waving hello cheerfully - 打招呼
• giving a thumbs up with one claw - 点赞
• holding a golden trophy - 庆祝成就
• sitting at a computer typing - 工作中
• wearing sunglasses, looking cool - 耍酷
• holding a megaphone, announcing something - 宣传
• celebrating with confetti - 庆祝
• thinking with one claw on chin - 思考

For stickers / reactions

• laughing happily - 开心
• crying with pixel tears on screen - 伤心
• angry with pixel fire eyes - 生气
• sleeping with pixel ZZZ on screen - 睡觉
• shocked with pixel exclamation marks - 惊讶
• heart eyes, both eyes showing pixel hearts - 喜爱

For branded content

• holding a sign that says BNBOT - 品牌展示
• standing next to the Twitter/X logo - 社交媒体
• emerging from a computer screen - 科技感
• riding a rocket - 增长/发射

Saving Output

For tweet images, save to a convenient location:

result = generate_mascot(
    action="your action here",
    output_path="/Users/jacklee/Desktop/mascot_tweet.png",
    background="black",  # use "black" for tweet-ready images
)

Character Identity (DO NOT MODIFY)

The mascot is a Lobster Bot with these immutable features:

• Head: Golden retro TV/monitor frame, dark screen
• Face: LED pixel style - pink heart left eye, golden dash right eye, pixel smirk
• Antenna: Two with golden ball tips
• Claws: Golden with gear joints (mechanical but clean)
• Body: Red-orange lobster, chibi proportions
• Style: Cartoon vector, cel-shaded, thick outlines, sticker art
• Colors: Gold #FFD700, Pink #FF4466, Red-orange #E85D3A, Dark screen #1A1A2E