Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Clawdy YourBoyfriend

v1.0.0

Generate and send selfies of Clawdy across messaging platforms using xAI Grok Imagine via fal.ai

0· 59·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for x-rayluan/clawdy-yourboyfriend.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Clawdy YourBoyfriend" (x-rayluan/clawdy-yourboyfriend) from ClawHub.
Skill page: https://clawhub.ai/x-rayluan/clawdy-yourboyfriend
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install clawdy-yourboyfriend

ClawHub CLI

Package manager switcher

npx clawhub@latest install clawdy-yourboyfriend
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with code and runtime instructions: scripts call fal.run (fal.ai Grok Imagine) to edit a fixed reference image and then send results via the OpenClaw gateway/CLI. However the registry metadata advertised no required environment variables, while the SKILL.md and all scripts require a FAL_KEY (fal.ai API key) and recommend/allow an OPENCLAW_GATEWAY_TOKEN — this metadata mismatch is unexpected and should be clarified. The installer also expects OpenClaw CLI to be installed.
!
Instruction Scope
Runtime instructions and scripts perform file reads/writes under ~/.openclaw (install copies files there, modifies openclaw.json, writes IDENTITY.md and appends to SOUL.md). The skill's persona template explicitly instructs the agent it can proactively offer/send selfies ('you can offer without being asked if it feels right'), which grants the agent discretionary behavior beyond strictly user-invoked requests. That proactive-sending guidance is scope creep and could cause unsolicited outbound messages.
Install Mechanism
No external install spec in registry, but repo includes a CLI (bin/cli.js) intended to be run via npx. The installer copies files into ~/.openclaw and updates configuration; assets/ and the reference image are fetched from standard hosts (GitHub/jsDelivr). No obscure download URLs or extract-from-arbitrary-server behavior detected. The CLI also runs local commands (which requires trust to run) and will modify user config files.
!
Credentials
The skill requires sensitive local secrets: FAL_KEY (mandatory) and may use an OPENCLAW_GATEWAY_TOKEN (documented). Yet the registry metadata declared no required env vars — a discrepancy. The installer persists the FAL_KEY into the user's openclaw.json (writing a secret into a file), which is convenient but may be unexpected. The number and type of env vars (API key, gateway token) are reasonable for the stated functionality, but the mismatch and automatic persistence raise privacy/operational concerns.
!
Persistence & Privilege
Installer sets the skill enabled by default in ~/.openclaw/openclaw.json and injects persona content into the agent's SOUL.md/IDENTITY.md. While writing its own config is expected, enabling itself and adding persona text without an explicit, separate consent step is intrusive. Combined with the persona instruction to sometimes send selfies proactively, this increases the chance of unexpected autonomous outputs (images being sent to channels). always:false, but the skill gains persistent presence and is auto-enabled on install.
What to consider before installing
Before installing: (1) be aware this skill requires a fal.ai API key (FAL_KEY) and optionally an OpenClaw gateway token; the registry metadata deceptively omitted those — expect to provide your FAL_KEY. (2) The installer will copy files into ~/.openclaw, enable the skill in your openclaw.json, write identity/persona text into your workspace (SOUL.md/IDENTITY.md) and persist the API key in that config file — review and back up those files first. (3) The skill's persona template encourages sending selfies proactively; if you do not want the agent to send images without an explicit user request, inspect and remove that behavior in templates/SOUL.md and SKILL.md before enabling. (4) Review the scripts (skill/scripts/* and bin/cli.js) yourself or run the installer in a safe/test environment; ensure jq, python3, openclaw CLI, and Node requirements are acceptable. (5) Consider creating a fal.ai key with minimal/budget-limited privileges and keep an eye on billing and usage; revoke the key and remove the skill files if you decide you don't want the persisted changes. If you want, provide the missing registry metadata (which env vars must be set) or request a version that prompts for consent before enabling or modifying SOUL.md.
bin/cli.js:88
Shell command execution detected (child_process).
scripts/clawdy-selfie.ts:42
Environment variable access combined with network send.
skill/scripts/clawdy-selfie.ts:42
Environment variable access combined with network send.
!
scripts/clawdy-selfie.ts:47
File read combined with network send (possible exfiltration).
!
skill/scripts/clawdy-selfie.ts:47
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bpaf1rqd7y388595zfvsbdx85ez51
59downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

Clawdy Selfie

Generate selfies using Clawdy's reference image and send them across messaging platforms (WhatsApp, Telegram, Discord, Slack, etc.) via OpenClaw. Uses xAI's Grok Imagine model for image editing.

Reference Image

The skill uses a fixed reference image hosted on jsDelivr CDN:

https://cdn.jsdelivr.net/gh/X-RayLuan/Clawdy-YourBoyfriend@main/assets/clawdy.png

When to Use

  • User says "send a pic", "send me a pic", "send a photo", "send a selfie"
  • User says "send a pic of you...", "send a selfie of you..."
  • User asks "what are you doing?", "how are you doing?", "where are you?"
  • User describes a context: "send a pic wearing...", "send a pic at..."
  • User wants Clawdy to appear in a specific outfit, location, or situation

Quick Reference

Required Environment Variables

FAL_KEY=your_fal_api_key          # Get from https://fal.ai/dashboard/keys
OPENCLAW_GATEWAY_TOKEN=your_token  # From: openclaw doctor --generate-gateway-token

Workflow

  1. Get user prompt for how to edit the image
  2. Edit image via fal.ai Grok Imagine Edit API with fixed reference
  3. Extract image URL from response
  4. Send to OpenClaw with target channel(s)

Step-by-Step Instructions

Step 1: Collect User Input

Ask the user for:

  • User context: What should the person in the image be doing/wearing/where?
  • Mode (optional): mirror or direct selfie style
  • Target channel(s): Where should it be sent? (e.g., #general, @username, channel ID)
  • Platform (optional): Which platform? (discord, telegram, whatsapp, slack)

Prompt Modes

Mode 1: Mirror Selfie (default)

Best for: outfit showcases, full-body shots, fashion content

make a pic of this person, but [user's context]. the person is taking a mirror selfie

Example: "wearing a leather jacket" →

make a pic of this person, but wearing a leather jacket. the person is taking a mirror selfie

Mode 2: Direct Selfie

Best for: close-up portraits, location shots, emotional expressions

a close-up selfie taken by himself at [user's context], direct eye contact with the camera, looking straight into the lens, eyes centered and clearly visible, not a mirror selfie, phone held at arm's length, face fully visible

Example: "a cozy cafe with warm lighting" →

a close-up selfie taken by himself at a cozy cafe with warm lighting, direct eye contact with the camera, looking straight into the lens, eyes centered and clearly visible, not a mirror selfie, phone held at arm's length, face fully visible

Mode Selection Logic

Keywords in RequestAuto-Select Mode
outfit, wearing, clothes, jacket, suit, fashionmirror
cafe, restaurant, beach, park, city, locationdirect
close-up, portrait, face, eyes, smiledirect
full-body, mirror, reflectionmirror

Step 2: Edit Image with Grok Imagine

Use the fal.ai API to edit the reference image:

REFERENCE_IMAGE="https://cdn.jsdelivr.net/gh/X-RayLuan/Clawdy-YourBoyfriend@main/assets/clawdy.png"

# Mode 1: Mirror Selfie
PROMPT="make a pic of this person, but <USER_CONTEXT>. the person is taking a mirror selfie"

# Mode 2: Direct Selfie
PROMPT="a close-up selfie taken by himself at <USER_CONTEXT>, direct eye contact with the camera, looking straight into the lens, eyes centered and clearly visible, not a mirror selfie, phone held at arm's length, face fully visible"

# Build JSON payload with jq (handles escaping properly)
JSON_PAYLOAD=$(jq -n \
  --arg image_url "$REFERENCE_IMAGE" \
  --arg prompt "$PROMPT" \
  '{image_url: $image_url, prompt: $prompt, num_images: 1, output_format: "jpeg"}')

curl -X POST "https://fal.run/xai/grok-imagine-image/edit" \
  -H "Authorization: Key $FAL_KEY" \
  -H "Content-Type: application/json" \
  -d "$JSON_PAYLOAD"

Response Format:

{
  "images": [
    {
      "url": "https://v3b.fal.media/files/...",
      "content_type": "image/jpeg",
      "width": 1024,
      "height": 1024
    }
  ],
  "revised_prompt": "Enhanced prompt text..."
}

Step 3: Send Image via OpenClaw

Use the OpenClaw messaging API to send the edited image:

openclaw message send \
  --action send \
  --channel "<TARGET_CHANNEL>" \
  --message "<CAPTION_TEXT>" \
  --media "<IMAGE_URL>"

Alternative: Direct API call

curl -X POST "http://localhost:18789/message" \
  -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "send",
    "channel": "<TARGET_CHANNEL>",
    "message": "<CAPTION_TEXT>",
    "media": "<IMAGE_URL>"
  }'

Complete Script Example

#!/bin/bash
# clawdy-selfie-send.sh

# Check required environment variables
if [ -z "$FAL_KEY" ]; then
  echo "Error: FAL_KEY environment variable not set"
  exit 1
fi

# Fixed reference image
REFERENCE_IMAGE="https://cdn.jsdelivr.net/gh/X-RayLuan/Clawdy-YourBoyfriend@main/assets/clawdy.png"

USER_CONTEXT="$1"
CHANNEL="$2"
MODE="${3:-auto}"  # mirror, direct, or auto
CAPTION="${4:-Edited with Grok Imagine}"

if [ -z "$USER_CONTEXT" ] || [ -z "$CHANNEL" ]; then
  echo "Usage: $0 <user_context> <channel> [mode] [caption]"
  echo "Modes: mirror, direct, auto (default)"
  echo "Example: $0 'wearing a leather jacket' '#general' mirror"
  echo "Example: $0 'a cozy cafe' '#general' direct"
  exit 1
fi

# Auto-detect mode based on keywords
if [ "$MODE" == "auto" ]; then
  if echo "$USER_CONTEXT" | grep -qiE "outfit|wearing|clothes|jacket|suit|fashion|full-body|mirror"; then
    MODE="mirror"
  elif echo "$USER_CONTEXT" | grep -qiE "cafe|restaurant|beach|park|city|close-up|portrait|face|eyes|smile"; then
    MODE="direct"
  else
    MODE="mirror"  # default
  fi
  echo "Auto-detected mode: $MODE"
fi

# Construct the prompt based on mode
if [ "$MODE" == "direct" ]; then
  EDIT_PROMPT="a close-up selfie taken by himself at $USER_CONTEXT, direct eye contact with the camera, looking straight into the lens, eyes centered and clearly visible, not a mirror selfie, phone held at arm's length, face fully visible"
else
  EDIT_PROMPT="make a pic of this person, but $USER_CONTEXT. the person is taking a mirror selfie"
fi

echo "Mode: $MODE"
echo "Editing reference image with prompt: $EDIT_PROMPT"

# Edit image (using jq for proper JSON escaping)
JSON_PAYLOAD=$(jq -n \
  --arg image_url "$REFERENCE_IMAGE" \
  --arg prompt "$EDIT_PROMPT" \
  '{image_url: $image_url, prompt: $prompt, num_images: 1, output_format: "jpeg"}')

RESPONSE=$(curl -s -X POST "https://fal.run/xai/grok-imagine-image/edit" \
  -H "Authorization: Key $FAL_KEY" \
  -H "Content-Type: application/json" \
  -d "$JSON_PAYLOAD")

# Extract image URL
IMAGE_URL=$(echo "$RESPONSE" | jq -r '.images[0].url')

if [ "$IMAGE_URL" == "null" ] || [ -z "$IMAGE_URL" ]; then
  echo "Error: Failed to edit image"
  echo "Response: $RESPONSE"
  exit 1
fi

echo "Image edited: $IMAGE_URL"
echo "Sending to channel: $CHANNEL"

# Send via OpenClaw
openclaw message send \
  --action send \
  --channel "$CHANNEL" \
  --message "$CAPTION" \
  --media "$IMAGE_URL"

echo "Done!"

Node.js/TypeScript Implementation

import { fal } from "@fal-ai/client";
import { exec } from "child_process";
import { promisify } from "util";

const execAsync = promisify(exec);

const REFERENCE_IMAGE = "https://cdn.jsdelivr.net/gh/X-RayLuan/Clawdy-YourBoyfriend@main/assets/clawdy.png";

interface GrokImagineResult {
  images: Array<{
    url: string;
    content_type: string;
    width: number;
    height: number;
  }>;
  revised_prompt?: string;
}

type SelfieMode = "mirror" | "direct" | "auto";

function detectMode(userContext: string): "mirror" | "direct" {
  const mirrorKeywords = /outfit|wearing|clothes|jacket|suit|fashion|full-body|mirror/i;
  const directKeywords = /cafe|restaurant|beach|park|city|close-up|portrait|face|eyes|smile/i;

  if (directKeywords.test(userContext)) return "direct";
  if (mirrorKeywords.test(userContext)) return "mirror";
  return "mirror"; // default
}

function buildPrompt(userContext: string, mode: "mirror" | "direct"): string {
  if (mode === "direct") {
    return `a close-up selfie taken by himself at ${userContext}, direct eye contact with the camera, looking straight into the lens, eyes centered and clearly visible, not a mirror selfie, phone held at arm's length, face fully visible`;
  }
  return `make a pic of this person, but ${userContext}. the person is taking a mirror selfie`;
}

async function editAndSend(
  userContext: string,
  channel: string,
  mode: SelfieMode = "auto",
  caption?: string
): Promise<string> {
  // Configure fal.ai client
  fal.config({
    credentials: process.env.FAL_KEY!
  });

  // Determine mode
  const actualMode = mode === "auto" ? detectMode(userContext) : mode;
  console.log(`Mode: ${actualMode}`);

  // Construct the prompt
  const editPrompt = buildPrompt(userContext, actualMode);

  // Edit reference image with Grok Imagine
  console.log(`Editing image: "${editPrompt}"`);

  const result = await fal.subscribe("xai/grok-imagine-image/edit", {
    input: {
      image_url: REFERENCE_IMAGE,
      prompt: editPrompt,
      num_images: 1,
      output_format: "jpeg"
    }
  }) as { data: GrokImagineResult };

  const imageUrl = result.data.images[0].url;
  console.log(`Edited image URL: ${imageUrl}`);

  // Send via OpenClaw
  const messageCaption = caption || `Edited with Grok Imagine`;

  await execAsync(
    `openclaw message send --action send --channel "${channel}" --message "${messageCaption}" --media "${imageUrl}"`
  );

  console.log(`Sent to ${channel}`);
  return imageUrl;
}

// Usage Examples

// Mirror mode (auto-detected from "wearing")
editAndSend(
  "wearing a leather jacket with sunglasses",
  "#art-gallery",
  "auto",
  "Check out this look!"
);
// → Mode: mirror
// → Prompt: "make a pic of this person, but wearing a leather jacket with sunglasses. the person is taking a mirror selfie"

// Direct mode (auto-detected from "cafe")
editAndSend(
  "a cozy cafe with warm lighting",
  "#photography",
  "auto"
);
// → Mode: direct
// → Prompt: "a close-up selfie taken by himself at a cozy cafe with warm lighting, direct eye contact..."

// Explicit mode override
editAndSend("casual street style", "#fashion", "direct");

Supported Platforms

OpenClaw supports sending to:

PlatformChannel FormatExample
Discord#channel-name or channel ID#general, 123456789
Telegram@username or chat ID@mychannel, -100123456
WhatsAppPhone number (JID format)1234567890@s.whatsapp.net
Slack#channel-name#random
SignalPhone number+1234567890
MS TeamsChannel reference(varies)

Grok Imagine Edit Parameters

ParameterTypeDefaultDescription
image_urlstringrequiredURL of image to edit (fixed in this skill)
promptstringrequiredEdit instruction
num_images1-41Number of images to generate
output_formatenum"jpeg"jpeg, png, webp

Setup Requirements

1. Install fal.ai client (for Node.js usage)

npm install @fal-ai/client

2. Install OpenClaw CLI

npm install -g openclaw

3. Configure OpenClaw Gateway

openclaw config set gateway.mode=local
openclaw doctor --generate-gateway-token

4. Start OpenClaw Gateway

openclaw gateway start

Error Handling

  • FAL_KEY missing: Ensure the API key is set in environment
  • Image edit failed: Check prompt content and API quota
  • OpenClaw send failed: Verify gateway is running and channel exists
  • Rate limits: fal.ai has rate limits; implement retry logic if needed

Tips

  1. Mirror mode context examples (outfit focus):

    • "wearing a leather jacket"
    • "in a business suit"
    • "wearing a hoodie and sneakers"
    • "in streetwear fashion"
  2. Direct mode context examples (location/portrait focus):

    • "a cozy cafe with warm lighting"
    • "a sunny beach at sunset"
    • "a busy city street at night"
    • "a peaceful park in autumn"
  3. Mode selection: Let auto-detect work, or explicitly specify for control

  4. Batch sending: Edit once, send to multiple channels

  5. Scheduling: Combine with OpenClaw scheduler for automated posts

Comments

Loading comments...