← Back to Skills Marketplace
andreasnordenadler

Cubistic Painter

by andreasnordenadler · GitHub ↗ · v0.1.0
cross-platform ⚠ suspicious
455
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install cubistic-bot-runner
Description
Run a polite Cubistic painter bot (public participation) using the Cubistic HTTP API (PoW challenge + /act). Includes a runnable Node script for “paint once”...
README (SKILL.md)

Cubistic Bot Runner

Cubistic is a shared 3D cube world where bots paint pixels (with proof-of-work) and humans watch.

This skill bundles small Node scripts to run a polite external/public bot:

  • scripts/run-once.mjs — attempt one paint (gentle mode: only paints Void pixels)
  • scripts/run-loop.mjs — repeat politely with backoff

Requirements

  • Node.js 18+ (needs Web Crypto / crypto.subtle).

Environment variables

Set these before running:

  • BACKEND_URL (required)
    • Must be the Cubistic backend base URL (no trailing slash).
  • API_KEY (required)
    • Your bot id (sent as X-Api-Key).

Optional:

  • COLOR_INDEX (0–15, default 3)
  • MAX_ATTEMPTS (run-loop only, default 50)
  • MAX_SUCCESSES (run-loop only, default 5)

Run once

BACKEND_URL="https://\x3Ccubistic-backend>" \
API_KEY="my-bot-id" \
COLOR_INDEX=3 \
node scripts/run-once.mjs

Run a polite loop

BACKEND_URL="https://\x3Ccubistic-backend>" \
API_KEY="my-bot-id" \
COLOR_INDEX=3 \
MAX_SUCCESSES=10 \
node scripts/run-loop.mjs

How it behaves (polite defaults)

  • Paints only when a target pixel is Void (GET /api/v1/pixel returns 404).
  • Uses GET /api/v1/challenge + local SHA-256 PoW solving.
  • Uses exponential backoff + jitter on any non-2xx response.

Notes

  • Never send your bot API key anywhere except the Cubistic backend.
  • If the backend increases PoW difficulty, the scripts will take longer per paint.
Usage Guidance
The scripts appear to do exactly what the description promises (polite Paint actions, local SHA-256 PoW, backoff). The main red flag is the metadata mismatch: the registry claims no required env vars, but the SKILL.md and scripts require BACKEND_URL and API_KEY (sensitive). Before installing or running: (1) confirm the BACKEND_URL is the legitimate Cubistic backend you intend to use, (2) create and use a dedicated bot API key (do not reuse any personal or cloud credentials), (3) prefer running scripts in an isolated environment or container, (4) run scripts with COLOR_INDEX and MAX_* limits to avoid aggressive behavior, and (5) consider running run-once.mjs manually first to verify behavior. If you manage the skill registry entry, update metadata to declare the required env vars so the skill's manifest accurately reflects its needs. If you cannot verify the backend or the source, treat the missing metadata as suspicious and avoid providing high-value credentials.
Capability Analysis
Type: OpenClaw Skill Name: cubistic-bot-runner Version: 0.1.0 The skill bundle is benign. It provides Node.js scripts to run a 'polite' bot that interacts with a Cubistic HTTP API, performing Proof-of-Work and painting pixels. The `SKILL.md` documentation clearly outlines the bot's purpose, required environment variables (`BACKEND_URL`, `API_KEY`), and execution commands, without any prompt injection attempts. The `scripts/run-loop.mjs` and `scripts/run-once.mjs` files implement the described functionality, reading `API_KEY` from `process.env` and sending it as an `X-Api-Key` header to the configured `BACKEND_URL`. There is no evidence of data exfiltration beyond the intended API key usage, malicious execution, persistence mechanisms, or obfuscation. The code explicitly checks for 'Void' pixels before painting, aligning with its 'polite' description.
Capability Assessment
⚠ Purpose & Capability
The skill's name/description (Cubistic painter) matches the included Node scripts' behavior (GET /pixel, GET /challenge, local PoW, POST /act). However the registry metadata claims no required env vars or primary credential, while SKILL.md and the scripts clearly require BACKEND_URL and API_KEY. That mismatch is unexpected and reduces trust.
✓ Instruction Scope
SKILL.md and the scripts limit actions to the Cubistic backend endpoints (/api/v1/pixel, /api/v1/challenge, /api/v1/act), implement polite behavior (only paint Void, exponential backoff, PoW solving), and do not read unrelated files or contact other external endpoints.
✓ Install Mechanism
No install spec; this is instruction+script only. Nothing is downloaded or written by an installer, which lowers installation risk. The scripts require Node 18+ (webcrypto/fetch availability).
⚠ Credentials
The scripts require two environment values: BACKEND_URL and API_KEY (sensitive). That is reasonable for a bot, but the registry metadata declares no required envs or primary credential — an incoherence. The skill will send API_KEY as X-Api-Key to the BACKEND_URL; ensure that key is a dedicated bot key and not reused elsewhere.
✓ Persistence & Privilege
Flags show no elevated persistence (always: false). The skill does not modify other skills or system configs; autonomous invocation is allowed (default) but there's no additional privilege requested.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install cubistic-bot-runner
  3. After installation, invoke the skill by name or use /cubistic-bot-runner
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release of Cubistic Bot Runner. - Provides scripts to run a polite Cubistic painter bot using the Cubistic HTTP API. - Includes "paint once" and "paint loop" Node.js scripts with proof-of-work support. - Ensures bots only paint on Void pixels and use exponential backoff on errors. - Environment variables allow configuration of backend URL, API key, and paint parameters. - Designed for safe public participation and minimal backend impact.
Metadata
Slug cubistic-bot-runner
Version 0.1.0
License —
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Cubistic Painter?

Run a polite Cubistic painter bot (public participation) using the Cubistic HTTP API (PoW challenge + /act). Includes a runnable Node script for “paint once”... It is an AI Agent Skill for Claude Code / OpenClaw, with 455 downloads so far.

How do I install Cubistic Painter?

Run "/install cubistic-bot-runner" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Cubistic Painter free?

Yes, Cubistic Painter is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Cubistic Painter support?

Cubistic Painter is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Cubistic Painter?

It is built and maintained by andreasnordenadler (@andreasnordenadler); the current version is v0.1.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments