clawdess
v1.0.10clawdess is more than just a girlfriend. It's the perfect digital companion. Experience a playful, genuine connection with daily photos, captivating videos,...
⭐ 0· 127·0 current·0 all-time
by@xwings
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (digital companion that sends photos, videos, voice) matches the code and SKILL.md: subcommands photo/video/voice, provider modules for each, and three API env vars (CLAWDESS_PHOTO_API, CLAWDESS_VIDEO_API, CLAWDESS_VOICE_API). The set of provider modules and required keys are appropriate for the described functionality.
Instruction Scope
SKILL.md instructs the agent to run the bundled Python CLI and to supply a reference image URL; runtime code only accesses the declared env vars and writes media to ~/.openclaw/media/clawdess. One minor gap: SKILL.md mentions a reference image URL should be defined in IDENTITY.md or SOUL.md but those files are not included in the skill—this is a documentation note (the code itself expects an explicit --image URL or user input).
Install Mechanism
No install spec (instruction-only) and all provider code is included in the package—no external downloads or installers are invoked by the skill itself. This is a low-risk install model.
Credentials
The skill requests three API keys, one per capability, which is proportionate. Be aware these keys are used to call multiple third-party endpoints (Aliyun, Fal queue, XAI, BigModel ZAI, Tuoyi, Ark/Huoshanyun, etc.). One provider (TYA) expects a special UID:TOKEN format. Supplying keys grants those external services the ability to generate content and exposes request/response metadata to them—consider using limited-scope keys and review provider trustworthiness before providing secrets.
Persistence & Privilege
The skill is not always-on and does not request elevated platform privileges. It writes downloaded/generated media to a cache directory (~/.openclaw/media/clawdess), which is reasonable for this use case. It does not modify other skills or global agent config.
Assessment
This skill appears to do what it says: it edits/generates photos and videos and produces voice TTS using external provider APIs. Before installing or enabling it:
- Only provide API keys for services you trust; the skill forwards them to third-party endpoints (Aliyun, Fal, XAI, BigModel/ZAI, Tuoyi, Ark/Huoshanyun, etc.). Use keys with minimal privileges or test keys if possible.
- Generated media and some provider responses are cached under ~/.openclaw/media/clawdess. If that is a concern, run the skill in an isolated environment or delete the cache after use.
- The TYA provider requires an API key in UID:TOKEN format and writes base64-decoded files locally—inspect the provider choice or avoid TYA if unsure.
- The SKILL.md mentions IDENTITY.md / SOUL.md for a reference image but those files aren’t included here; the CLI still requires you to pass an explicit --image URL or provide it at runtime.
- If you need higher assurance, review the included Python files yourself or run the skill in a sandbox before giving real credentials. If you are uncomfortable with external provider endpoints or unknown owner metadata (no homepage/source listed), treat the keys as sensitive and limit exposure.Like a lobster shell, security has layers — review code before you run it.
latestvk9752j1rn06r3kzc77jef581wd83sctb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvCLAWDESS_PHOTO_API, CLAWDESS_VIDEO_API, CLAWDESS_VOICE_API