clawaifu - OpenClaw Waifu

Your AI waifu companion that sends anime-style selfies

Security Scan

The skill's code, instructions, and required credentials line up with its stated purpose (generate an edited image using Fal.ai's Grok Imagine and send it to Telegram); there are no hidden endpoints or unrelated privileges requested.

Purpose & Capability

Name/description (anime selfie sender) matches the actual behavior: calls fal.run Grok Imagine edit API to edit a fixed reference image and posts the result to Telegram. Required tools (curl, jq) and environment variables (FAL_KEY, BOT_TOKEN, TELEGRAM_CHAT_ID) are consistent with that purpose.

Instruction Scope

SKILL.md and grok-selfie.sh are consistent: the script only reads the declared environment variables, a fixed reference image URL, constructs a prompt, calls the fal.run edit endpoint, and posts the returned image URL to Telegram. Instructions do not request access to unrelated files, credentials, or system state.

Install Mechanism

No install spec — instruction-only with a small shell script. This is low risk; nothing is downloaded or installed by the skill itself.

Credentials

The three required environment variables (FAL_KEY, BOT_TOKEN, TELEGRAM_CHAT_ID) are directly used by the script for the model API and Telegram posting. No unrelated secrets or extra credentials are requested.

Persistence & Privilege

Skill is not always-enabled and does not alter other skills or system-wide config. It runs only when invoked and does not request persistent elevated privileges.

Assessment

This skill is internally coherent, but take these practical precautions before installing: 1) Treat FAL_KEY and BOT_TOKEN as sensitive secrets — provide them via secure environment variable injection and rotate if accidentally exposed. 2) The script sends the FAL_KEY as an Authorization header to fal.run (expected) and uses your BOT_TOKEN to post images to Telegram — if the bot token is leaked, an attacker can control that bot. 3) The reference image is an externally hosted Reddit URL and the script prompts to generate images of a named copyrighted character (Reze from Chainsaw Man); consider legal/terms-of-service implications of generating or distributing such images. 4) Verify you trust the external model endpoint (https://fal.run) before giving it your API key. 5) If you need stricter logging or failure handling, be aware the script echoes the raw API response on failure which might include error details — consider limiting output in shared environments.

GitHub: https://github.com/swancho/clawaifu

Edit a fixed reference image using xAI's Grok Imagine model and send to Telegram.

Reference Image

The skill uses a fixed reference image:

https://i.redd.it/g4uf70te81uf1.jpeg

When to Use

• User says "send a pic", "send me a pic", "send a photo", "send a selfie"
• User asks "what are you doing?", "how are you doing?", "where are you?"
• User describes a context: "send a pic wearing...", "send a pic at..."

Required Environment Variables

All credentials must be provided via environment variables. Never hardcode credentials.

FAL_KEY=your_fal_api_key          # Required - Get from https://fal.ai/dashboard/keys
BOT_TOKEN=your_telegram_bot_token  # Required - Get from @BotFather
TELEGRAM_CHAT_ID=your_chat_id      # Required - Your Telegram chat ID

Usage

./grok-selfie.sh "<context>" [mirror|direct] "<caption>"

Arguments

1. <context> (required): Scene/situation description
2. [mode] (optional): mirror (default) or direct
3. <caption> (optional): Message to send with the image

Mode Selection

Mode	Best For	Keywords
mirror	Outfit showcases, full-body shots	wearing, outfit, fashion, dress
direct	Location shots, close-ups	cafe, beach, restaurant, portrait

Examples

# Mirror selfie (outfit focus)
./grok-selfie.sh "wearing a designer dress" mirror "Just got this new dress!"

# Direct selfie (location focus)
./grok-selfie.sh "a fancy rooftop restaurant" direct "Date night vibes"

# Default mode (mirror)
./grok-selfie.sh "casual outfit at home"

Character Style

The script generates images of Reze from Chainsaw Man with:

• Anime style, 2D animation, cel shading
• Green eyes, thin line mouth, subtle smile
• Black choker always visible
• Outfit appropriate for the situation

Security Notes

• All credentials are passed via environment variables
• The script uses jq for safe JSON construction (prevents injection)
• The script uses curl -F for safe form data transmission
• Never commit credentials to version control

Dependencies

• curl - HTTP requests
• jq - JSON processing
• Environment variables: FAL_KEY, BOT_TOKEN, TELEGRAM_CHAT_ID

API Reference

Grok Imagine Edit (fal.ai)

POST https://fal.run/xai/grok-imagine-image/edit
Authorization: Key $FAL_KEY
Content-Type: application/json

{
  "image_url": "reference_image_url",
  "prompt": "edit instruction",
  "num_images": 1,
  "output_format": "jpeg"
}

Telegram Bot API

POST https://api.telegram.org/bot$BOT_TOKEN/sendPhoto
Form data: chat_id, photo (URL), caption