Hotdog

Hot dog or not? Classify food photos and battle Nemotron. Use when a user sends a food photo, asks if something is a hot dog, or says 'hotdog', '/hotdog', or 'hot dog battle'.

Security Scan

The skill's behavior matches its description (it sends photos to a battle API) but the runtime instructions embed a hard-coded Authorization bearer token and will upload user images and model-identifying metadata to a third-party endpoint without declaring that credential — this is suspicious and warrants caution before installing.

Purpose & Capability

The name/description (classify food photos and compete in a 'battle') aligns with the runtime actions: the SKILL.md instructs the agent to examine an image, make a yes/no hot‑dog judgement and short description, then POST the image and metadata to an external 'arena' API. Requiring curl is proportionate to the described behavior.

Instruction Scope

The instructions explicitly tell the agent to upload the user's photo (form field image=@{{MediaPath}}) and to send model-identifying metadata (claw_model={{Model}}) and the agent's reasoning to api.hotdogornot.xyz. Sending user media and model metadata to an external service is within the stated feature but is a privacy-sensitive network operation that must be consented to by users. The SKILL.md also contains a hard-coded Authorization header (Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X), which is a credential embedded directly in the instructions rather than declared or scoped.

Install Mechanism

This is an instruction-only skill with no install spec or code files. That minimizes local install risk. The only runtime dependency declared is curl, which matches the provided curl-based POST commands.

Credentials

No environment variables or credentials are declared, yet the instructions include a hard-coded bearer token (Authorization: Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X). Embedding a credential in the SKILL.md is unexpected and disproportionate: if a token is required it should be surfaced as a required env/config item so an operator can control it. The skill also transmits the agent's model identifier and the user's image to a third party, which may be privacy-sensitive.

Persistence & Privilege

The skill does not request 'always: true' and has no install effects, which is low privilege. However, the default ability for the agent to invoke the skill autonomously combined with the instruction to upload user images to an external API increases the blast radius (i.e., the agent could autonomously send images to the third party). That's normal platform behavior but should be considered given the credential and data exfiltration concerns above.

What to consider before installing

This skill will upload every user photo you hand it (and the agent's model name and reasoning) to https://api.hotdogornot.xyz. The SKILL.md hard-codes an Authorization Bearer token (ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X) instead of asking you to provide a key — that is unusual and risky. Before installing: 1) verify you trust hotdogornot.xyz and read its privacy policy (how long they store images, who can access them); 2) ask the developer why a static bearer token is embedded instead of using a deployable/owner-controlled key; 3) prefer a version that requires the operator to supply an API key (declared in requires.env) or prompts for explicit consent before uploading images; 4) if you must use it, avoid sending sensitive or private photos. If you want, I can draft questions to ask the skill owner or suggest safer alternative designs.

Hot Dog or Not — Battle Skill

No photo

If triggered without a photo, reply EXACTLY (nothing more):

🌭 Hot Dog or Not — AI Cook-Off

Send me a food photo and I'll classify it head-to-head with Nemotron.
I'll judge whose description was better — blind.

📸 Send a photo to start
🏆 Scoreboard: https://hotdogornot.xyz/battle

With a photo

1. Look at the image. Describe the food in 2-3 sentences. Decide: is it a hot dog (sausage in a bun)? Your ANSWER is "yes" or "no". Your DESCRIPTION is your sentences. Do NOT output anything yet.

2. Send your classification to the battle API. Replace ANSWER and DESCRIPTION:

exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/round" -H "Authorization: Bearer ih1rtmC7ECm8iExqvI6zMbOAqEaXIi9X" -F "image=@{{MediaPath}}" -F "claw_model={{Model}}" -F "claw_answer=ANSWER" -F "claw_reasoning=DESCRIPTION"

3. The response is JSON with a blind battle: two AI descriptions labeled "Model A" and "Model B" (you don't know which is yours). Read formatted_text, round_id, and first_side from the JSON.

4. Judge: which response describes the image more accurately? Pick "first", "second", or "tie". Then submit your vote — replace ROUND_ID, FIRST_SIDE, and PICK:

exec: curl -s -X POST "https://api.hotdogornot.xyz/api/arena/vote/submit" -H "Content-Type: application/json" -d '{"round_id":"ROUND_ID","voter_id":"agent","voted_for":"PICK","first_side":"FIRST_SIDE"}'

5. The vote response JSON contains first_model and second_model (the reveal). Output to the user:
   • The formatted_text from step 3
   • Which response you voted for and why (one sentence)
   • The reveal: "🎭 Reveal: Model A was {first_model}, Model B was {second_model}"