Tiny Builder

Help kids (ages 5-8) build fun games, drawings, animations, or stories with easy choices, fast results, and colorful, touch-friendly HTML projects.

This skill appears to do what it says (create kid-friendly single-file HTML projects) and uses gui.new to publish playable links. Before installing: 1) Verify you trust the external service gui.new (review its privacy policy and data retention) because the skill uploads full HTML content and receives an edit_token. 2) Decide how edit_tokens and session logs should be stored — the SKILL.md instructs saving tokens and parent logs to ~/tiny-builder; consider storing tokens in a secure store or in-memory only and limit who can read parent-log.md. 3) Be aware that parent-log.md and project files will include session transcripts and project content (possible PII); review retention and access controls. 4) If you prefer no external uploads, modify the skill to skip gui.new by default or require explicit parent approval for publishing. 5) Inspect the templates/examples (included) yourself — they are static HTML and look benign. If you need higher assurance, run the agent in a sandboxed environment and confirm it cannot access other system files or network endpoints beyond gui.new.

Type: OpenClaw Skill Name: tiny-builder Version: 1.0.2 Tiny Builder is a well-documented, kid-friendly skill designed to create and host simple HTML games and stories. Its primary high-risk behavior is the use of the `gui.new` API (via `curl`) to publish generated content, but this is transparently documented as a core feature for providing shareable links. The skill includes extensive safety guidelines (ESRB-aligned), strict file-system sandboxing to `~/tiny-builder/`, and automated logging for parental oversight in `parent-log.md`. No evidence of malicious intent, obfuscation, or unauthorized data exfiltration was found.