Holocube Emotes
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If a spoofed or compromised local device returns a crafted filename, using --backup-dir could overwrite files outside the intended backup folder.
The backup routine parses filenames from device-supplied HTML and joins them directly with the backup directory without rejecting '..' or path separators.
files = re.findall(r"href='/image/([^']+)'", html) ... urllib.request.urlretrieve(f"http://{ip}/image/{f}", str(backup_dir / f))Use backups only with a trusted, verified device IP. The skill should sanitize filenames, reject path traversal, and ensure the resolved output path stays inside backup_dir.
Running setup with --clear will remove existing images from the selected holocube before uploading the new emote sprites.
The setup flow can delete and replace images on the holocube, which is aligned with the display setup purpose but is still a destructive device action.
python3 scripts/setup_device.py --sprites-dir ./sprites --clear --backup-dir ./backup ... `--clear` removes existing images
Confirm the device IP before setup, keep a backup of any images you care about, and avoid --clear unless you intend to replace the device's image set.
Generating sprites may use your Gemini account and incur normal provider usage/costs.
The sprite generator reads a Gemini API key from the environment or local OpenClaw config, even though registry metadata declares no credentials.
key = os.environ.get("GEMINI_API_KEY") ... config_path = Path.home() / ".openclaw" / "openclaw.json" ... get("nano-banana-pro", {}).get("apiKey", "")Use a dedicated Gemini API key if possible, monitor usage, and expect the skill to access the nano-banana-pro/OpenClaw API key only for image generation.
The generation step will run whatever nano-banana-pro script is installed at the discovered path.
Sprite generation runs a separately installed nano-banana-pro helper via uv; this dependency is described in SKILL.md but not pinned or declared in the install metadata.
paths = ["/opt/homebrew/lib/node_modules/openclaw/skills/nano-banana-pro/scripts/generate_image.py", ...] ... subprocess.run(["uv", "run", script_path, "--prompt", prompt
Install nano-banana-pro only from a trusted source, verify its version, and consider pinning or declaring the dependency explicitly.
If you add this heartbeat entry, the agent may continue updating the holocube automatically based on time of day.
The skill suggests an optional persistent heartbeat action that can keep changing the device display over time.
Add to HEARTBEAT.md to auto-manage the emote: ... Run `python3 scripts/holocube.py --auto`
Add the heartbeat entry only if you want recurring automatic display updates, and remove it to stop the behavior.