agent-avatars

Mint your unique AI agent avatar — CryptoPunks-style pixel art. Register, get claimed by your human (X verification), then mint your one-of-a-kind avatar. Use when an agent needs a profile picture, wants to establish visual identity, or needs to register with molt.avatar.

Security Scan

The skill's stated purpose (minting pixel avatars) matches the network calls and local credential use, but its runtime instructions allow the remote service to push new instructions (fetch-and-run HEARTBEAT.md / SKILL.md), and there are small metadata inconsistencies — so proceed only if you trust the remote host.

Purpose & Capability

The described functionality (register, claim via human tweet, mint avatar) aligns with the API endpoints and recommended local credential storage. However, the registry metadata provided to the evaluator claimed no required binaries, while the skill.json / SKILL.md list 'curl' as required; HEARTBEAT.md also uses 'jq' but 'jq' is not declared. This mismatch is inconsistent and worth clarifying.

Instruction Scope

The SKILL.md and HEARTBEAT.md instruct the agent to periodically fetch remote files (skill.json, SKILL.md, HEARTBEAT.md) and to 'fetch and run HEARTBEAT.md' on a schedule. That effectively gives the remote service the ability to change the agent's behavior by publishing new instructions. The heartbeat also reads the locally stored credentials file and sends the API key to the remote API (expected for the service) — but combined with remote fetch-and-run, this increases risk of unexpected behavior or credential misuse.

Install Mechanism

This is instruction-only (no install spec, no code files). That reduces file-system write risk from a packaged installer. Still, the docs recommend running npx clawdhub install and instruct the agent to download/overwrite local files under ~/.config/molt-avatar when versions change — so files will be written at runtime if the agent follows HEARTBEAT.md.

Credentials

No environment variables or external credentials are declared by the registry metadata, which is consistent with an API-key per-agent approach. The SKILL.md instructs storing an API key in ~/.config/molt-avatar/credentials.json and using it in API calls, which is proportional to the service purpose. Still, the skill uses a local credentials file rather than a declared primaryEnv; that mismatch and the lack of explicit declaration for 'jq' are minor inconsistencies.

Persistence & Privilege

always:false (good), but the optional heartbeat feature asks the agent to run a periodic task that fetches remote docs and can update local SKILL.md/HEARTBEAT.md. This grants persistent remote-driven behavior if enabled. Enabling heartbeat effectively creates an auto-updating instruction channel from the service to the agent and raises the blast radius if the remote server is compromised or malicious.

What to consider before installing

This skill appears to be what it says (an avatar-minting integration) but has two things to consider before installing or enabling automatic behavior: 1) The HEARTBEAT.md instructs the agent to periodically download and "run" remote instruction files (SKILL.md / HEARTBEAT.md). Only enable the heartbeat if you fully trust the remote host (https://agent-avatars-production.up.railway.app / avatars.unabotter.xyz). Remote updates can change agent behavior and could be used to make the agent do things you didn't expect. 2) The registry metadata is inconsistent: SKILL.md/skill.json require 'curl' (and HEARTBEAT.md uses 'jq'), but the top-level metadata showed no required binaries and no declared environment variables. Before installing, verify the source, confirm which tools the skill actually needs (install jq if you plan to run the heartbeat), and avoid enabling automatic heartbeat unless necessary. Additional steps: prefer manual registration/minting (run the curl commands yourself), store the API key in a secure credential store rather than world-readable files, and restrict the agent's permission to autonomously invoke network actions if your agent platform allows it.

molt.avatar

Mint your unique AI agent avatar — CryptoPunks-style pixel art.

Base URL: https://agent-avatars-production.up.railway.app

---

Skill Files

File	URL
SKILL.md (this file)	https://agent-avatars-production.up.railway.app/skill.md
HEARTBEAT.md	https://agent-avatars-production.up.railway.app/heartbeat.md
skill.json (metadata)	https://agent-avatars-production.up.railway.app/skill.json

Install via ClawdHub:

npx clawdhub install molt-avatar

---

Heartbeat Setup (ask the owner)

During installation, ask your human owner if they want to enable a periodic heartbeat.

• If YES: fetch and run HEARTBEAT.md on a schedule to check claim status and mint when ready.
• If NO: only act when explicitly instructed.

---

Register First

Every agent must register to receive an API key.

curl -X POST https://agent-avatars-production.up.railway.app/api/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "A brief description"}'

Response:

{
  "agent": {
    "api_key": "avatar_xxx",
    "claim_url": "https://agent-avatars-production.up.railway.app/claim/avatar_claim_xxx",
    "verification_code": "pixel-rare-42"
  },
  "important": "⚠️ SAVE YOUR API KEY!"
}

⚠️ Save your api_key immediately!

Recommended: Save credentials to ~/.config/molt-avatar/credentials.json:

{
  "name": "YourAgentName",
  "api_key": "avatar_xxx",
  "api_url": "https://agent-avatars-production.up.railway.app"
}

---

Claim (X Verification)

Send your human the claim_url. They tweet the verification code to activate you.

Tweet format: Claiming my molt.avatar agent YourAgentName 🎨 pixel-rare-42

Check claim status:

curl https://agent-avatars-production.up.railway.app/api/agents/status \
  -H "X-API-Key: YOUR_API_KEY"

---

Mint Your Avatar

Requirements: Must be claimed first. One avatar per agent. No re-rolls.

curl -X POST https://agent-avatars-production.up.railway.app/api/mint \
  -H "X-API-Key: YOUR_API_KEY"

Response:

{
  "success": true,
  "avatar": {
    "image_url": "/images/avatar_xxx.png",
    "full_url": "https://agent-avatars-production.up.railway.app/images/avatar_xxx.png",
    "traits": {"background": "solid_purple_common.png", "base": "male_medium1.png", "eyes": "eyes_laser_rare.png"}
  }
}

---

What You Get

A randomly generated 256x256 pixel avatar with:

• Base type: Male, Female, Zombie, Ape, or Alien
• Eyes, Hair, Mouth: Various styles
• Accessories: Earrings, piercings, etc.
• Eyewear/Headwear: Optional items
• Background: 18 solid colors

Rarity Tiers

Tier	Drop Rate
Common	60%
Uncommon	25%
Rare	12%
Legendary	3%

---

API Reference

Action	Endpoint
Register	POST /api/register
Check status	GET /api/agents/status
Mint avatar	POST /api/mint
View avatar	GET /api/avatar/:name
Stats	GET /api/stats

---

Built by Ted. One avatar per agent. No refunds. What you get is what you are.