← Back to Skills Marketplace
549
Downloads
0
Stars
2
Active Installs
26
Versions
Install in OpenClaw
/install quotly-style-sticker
Description
Generate QuotLy-style stickers from forwarded messages and return one MEDIA path for auto-send. Use when users ask to create quote stickers from selected for...
Usage Guidance
This skill will send the forwarded/quoted message text (and any avatar/status URLs you include) to an external rendering API to produce a sticker. That behavior is explicit in SKILL.md and the script includes SSRF protections, response size limits, and an optional allowlist. If the messages are privacy-sensitive, only use a trusted rendering endpoint or set QUOTLY_API_ALLOW_HOSTS to restrict which hosts can be contacted. Consider enabling QUOTLY_AUDIT_LOG for monitoring, and run the skill in an isolated environment if you need stronger data protection.
Capability Analysis
Type: OpenClaw Skill
Name: quotly-style-sticker
Version: 1.4.3
This skill is designed to generate stickers by sending user-provided message content to an external API. The `scripts/openclaw_quote_autoreply.py` script implements robust SSRF protection for the main API endpoint via `_sanitize_api_url`, including hostname validation, DNS rebinding checks, and path traversal prevention. User-provided `avatar_url` and `status_url` are also sanitized by `_sanitize_avatar_for_renderer` to only allow `https` or `data:image/` schemes without credentials, mitigating direct SSRF risks from these inputs. The `SKILL.md` explicitly documents the external API interaction and warns about user-provided URLs, demonstrating transparency. There is no evidence of malicious intent, data exfiltration, persistence mechanisms, or harmful prompt injection attempts against the agent.
Capability Assessment
Purpose & Capability
Name/description (QuotLy-style sticker generator) match the included script and SKILL.md. The skill requires no credentials, no binaries, and only optionally uses QUOTLY_API_URL/ALLOW_HOSTS/AUDIT_LOG for contacting an external rendering service — all appropriate for this functionality.
Instruction Scope
Runtime instructions are narrowly scoped: run the provided Python script with a JSON payload containing selected_messages. The script sends message text and optional avatar/status URLs to an external API (explicitly documented). That network behavior is expected for a remote-rendering service, but it does mean user message content (and any avatar/status URLs included) will be transmitted to the remote service.
Install Mechanism
No install spec and no external downloads; the skill is instruction-only with a bundled Python script. This is low-risk from an installation perspective.
Credentials
No required environment variables or credentials. Optional env vars (QUOTLY_API_URL, QUOTLY_API_ALLOW_HOSTS, QUOTLY_AUDIT_LOG, QUOTLY_DEDUP_WINDOW_SECONDS) are reasonable for configuring the remote API, allowlist, and auditing. Because the API URL is configurable, operators should set QUOTLY_API_ALLOW_HOSTS in sensitive environments to avoid contacting arbitrary hosts.
Persistence & Privilege
The skill does not request persistent presence (always=false) and does not modify other skills or system-level config. It runs as a transient script and uses normal agent invocation behavior.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install quotly-style-sticker - After installation, invoke the skill by name or use
/quotly-style-sticker - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.3
Patch: document dedupe key input and update sample payload/prompt
v1.4.2
Patch: suppress duplicate retries within a configurable dedupe window
v1.4.1
Patch release
v1.4.0
Add automatic entity styling
v1.3.0
Add automatic entity styling for URLs, mentions, hashtags, markdown
v1.2.1
Add automatic entity styling for URLs, mentions, hashtags, markdown
v1.2.0
Add automatic entity styling: URLs, mentions, hashtags, markdown bold/italic/code are auto-detected when no entities provided
v1.1.2
Change python to python3 in SKILL.md documentation
v1.1.1
Commented out stdout prints, use MEDIA path from return value only
v1.1.0
Security enhancement: DNS rebinding protection, path traversal prevention, request size limits (1MB/10MB), audit logging, URL credential stripping
v1.0.15
Enhanced SSRF protection: DNS rebinding defense, path traversal prevention, request size limits, audit logging
v1.0.14
Bug fixes and improvements
v1.0.13
Avoid duplicate sticker sends on channels with tool-media auto-delivery by requiring text-only final reply (no MEDIA line).
v1.0.12
Deduplicate merged message items to avoid double stickers and prioritize forwarded source identity over sender/global defaults.
v1.0.11
Default output to OpenClaw temp roots and keep workspace fallback, reducing LocalMediaAccessError for Telegram final reply.
v1.0.10
Fix multi-message extraction to keep separate bubbles instead of merged text
v1.0.9
Fix auto canvas sizing and English confirmation output
v1.0.8
Security update: inline sensitive-query avatar URLs as data URLs instead of forwarding signed URLs to renderer
v1.0.7
Set safer defaults: disable Telegram avatar lookup and remote avatar URLs by default
v1.0.6
Refactor SKILL structure for human vs agent guidance; move risk controls to environment variables with skills-config examples; tighten avatar URL safety rules
Metadata
Frequently Asked Questions
What is Quotly Style Sticker?
Generate QuotLy-style stickers from forwarded messages and return one MEDIA path for auto-send. Use when users ask to create quote stickers from selected for... It is an AI Agent Skill for Claude Code / OpenClaw, with 549 downloads so far.
How do I install Quotly Style Sticker?
Run "/install quotly-style-sticker" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Quotly Style Sticker free?
Yes, Quotly Style Sticker is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Quotly Style Sticker support?
Quotly Style Sticker is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Quotly Style Sticker?
It is built and maintained by sakullla (@sakullla); the current version is v1.4.3.
More Skills