← Back to Skills Marketplace
cinnabarhorse

Aavegotchi 3D Renderer

by cinnabarhorse · GitHub ↗ · v0.1.2
cross-platform ⚠ suspicious
556
Downloads
0
Stars
3
Active Installs
3
Versions
Install in OpenClaw
/install aavegotchi-3d-renderer
Description
Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use...
README (SKILL.md)

Aavegotchi 3D Renderer

Render gotchi assets from token data and renderer batch APIs.

Inputs

  • Accept either tokenId or inventory URL with id=\x3CtokenId>.
  • Target Base by default (chainId=8453).

Outputs

  • Return derived renderer hash.
  • Return /api/renderer/batch HTTP status.
  • Save raw batch JSON to disk.
  • Save PNG_Full and PNG_Headshot to disk when available.
  • Return GLB_3DModel availability and URL when present.

Execute

  1. Extract tokenId from direct input or inventory URL.
  2. Query Goldsky Base core subgraph: https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn
  3. Derive hash in renderer format: \x3CCollateral>-\x3CEyeShape>-\x3CEyeColor>-\x3CBody>-\x3CFace>-\x3CEyes>-\x3CHead>-\x3CRightHand>-\x3CLeftHand>-\x3CPet>
  4. Kick off render with POST https://www.aavegotchi.com/api/renderer/batch using:
  • force: true
  • verify: false
  • renderTypes: ["PNG_Full", "PNG_Headshot", "GLB_3DModel"]
  1. Poll POST /api/renderer/batch with verify: true until availability.exists=true for all requested render types or timeout.
  2. Download proxyUrls.PNG_Full and proxyUrls.PNG_Headshot only when corresponding availability.exists=true.
  3. Return the hash, kickoff + verify responses, poll summary, and saved artifact paths.

Command

Run the bundled script:

node scripts/render-gotchi-bypass.mjs --token-id 6741

Or pass an inventory URL:

node scripts/render-gotchi-bypass.mjs \
  --inventory-url "https://www.aavegotchi.com/u/0x.../inventory?itemType=aavegotchis&chainId=8453&id=6741"

Use --out-dir /tmp to control artifact location (default: /tmp).

Optional polling controls:

--poll-attempts 18 --poll-interval-ms 10000

Return format

Always return:

  1. tokenId
  2. hash
  3. Kickoff status, verify status, and raw JSON paths
  4. Poll summary (pollAttempts, pollIntervalMs, renderReady)
  5. PNG_Full and PNG_Headshot output paths (or missing reason)
  6. GLB_3DModel availability and URL when present

Troubleshooting

  • If Goldsky returns no gotchi, verify tokenId and Base context.
  • If batch returns hash-format 400, verify eye mappings and right/left wearable order (index4 then index5).
  • If availability.exists is false, ensure kickoff used force:true, then keep polling verify:true until timeout.
  • If endpoint returns 404, verify production deployment state.
Usage Guidance
This skill appears to do what it says: it queries Goldsky and Aavegotchi APIs, derives a renderer hash, starts/polls renders, and writes artifacts to disk. Before running, note: (1) you need Node.js to execute the bundled script (the metadata omits this requirement); Node 18+ is recommended because the script uses global fetch; (2) the script will make network requests to external services (https://api.goldsky.com and https://www.aavegotchi.com) and will save JSON and image/GLB files (default /tmp) — run it in a controlled environment if you are concerned about disk writes or network traffic; (3) review the script source yourself (it is bundled) if you have any trust concerns. No credentials are requested or transmitted by the skill.
Capability Analysis
Type: OpenClaw Skill Name: aavegotchi-3d-renderer Version: 0.1.2 The skill is classified as suspicious due to the presence of an arbitrary file write vulnerability and a potential supply chain risk. The `scripts/render-gotchi-bypass.mjs` script allows users to specify an output directory via the `--out-dir` argument, which defaults to `/tmp` but can be set to any path. This enables writing JSON and PNG files to arbitrary locations on the file system, posing a risk if a malicious path (e.g., `/etc/cron.d`, `~/.ssh`) is provided. Additionally, the script downloads image artifacts from `proxyUrls` provided by the `www.aavegotchi.com` API. While the base URL is hardcoded, a compromise of the `www.aavegotchi.com` API could lead to the agent downloading malicious content from attacker-controlled URLs.
Capability Assessment
Purpose & Capability
The skill is described as a renderer helper and its code performs exactly that: query Goldsky subgraph, derive a renderer hash, POST to Aavegotchi's /api/renderer/batch, poll, and download artifacts. One minor incoherence: SKILL.md and README instruct running the bundled Node script (node scripts/render-gotchi-bypass.mjs) but the registry metadata lists no required binaries — the runtime implicitly requires a Node.js environment (and likely Node 18+ for global fetch). This is a documentation/metadata omission, not evidence of malicious intent.
Instruction Scope
The runtime instructions are narrowly scoped to the stated task: extract tokenId, query a Goldsky subgraph, derive a hash, kick off and verify renders via Aavegotchi's renderer API, poll until availability, and download specified artifacts. The instructions do not request unrelated files, credentials, or unexpected external endpoints.
Install Mechanism
There is no install spec (instruction-only with a bundled script). That is low risk, but the bundled script will be executed directly by Node — there is no packaged/verified install step. The script embeds the Goldsky and Aavegotchi endpoints but does not fetch or execute code from arbitrary third-party URLs. Users should be aware the script writes files to disk (default /tmp).
Credentials
The skill declares no environment variables or credentials and the code does not attempt to read secrets. Network access is required to the Goldsky subgraph and aavegotchi.com renderer API, which is appropriate for the stated function.
Persistence & Privilege
always is false and the skill does not request persistent platform privileges. It only writes output artifacts to a configurable out-dir (default /tmp) and does not attempt to modify other skills or system configuration.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install aavegotchi-3d-renderer
  3. After installation, invoke the skill by name or use /aavegotchi-3d-renderer
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.2
Release 0.1.2: force renderer kickoff (force:true, verify:false), add verify polling, and return clear availability/missing reasons for artifacts.
v0.1.1
Release 0.1.1: fix renderer hash hand-slot order (RightHand then LeftHand) to prevent 403 asset misses for valid gotchis.
v0.1.0
Set canonical skill name to aavegotchi-3d-renderer.
Metadata
Slug aavegotchi-3d-renderer
Version 0.1.2
License
All-time Installs 3
Active Installs 3
Total Versions 3
Frequently Asked Questions

What is Aavegotchi 3D Renderer?

Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use... It is an AI Agent Skill for Claude Code / OpenClaw, with 556 downloads so far.

How do I install Aavegotchi 3D Renderer?

Run "/install aavegotchi-3d-renderer" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Aavegotchi 3D Renderer free?

Yes, Aavegotchi 3D Renderer is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Aavegotchi 3D Renderer support?

Aavegotchi 3D Renderer is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Aavegotchi 3D Renderer?

It is built and maintained by cinnabarhorse (@cinnabarhorse); the current version is v0.1.2.

💬 Comments