← Back to Skills Marketplace
cinnabarhorse

Aavegotchi Renderer Bypass

by cinnabarhorse · GitHub ↗ · v0.1.0
cross-platform ⚠ suspicious
545
Downloads
0
Stars
3
Active Installs
1
Versions
Install in OpenClaw
/install aavegotchi-renderer-bypass
Description
Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use...
README (SKILL.md)

Aavegotchi Renderer Bypass

Render gotchi assets from token data and renderer batch APIs.

Inputs

  • Accept either tokenId or inventory URL with id=\x3CtokenId>.
  • Target Base by default (chainId=8453).

Outputs

  • Return derived renderer hash.
  • Return /api/renderer/batch HTTP status.
  • Save raw batch JSON to disk.
  • Save PNG_Full and PNG_Headshot to disk when available.
  • Return GLB_3DModel availability and URL when present.

Execute

  1. Extract tokenId from direct input or inventory URL.
  2. Query Goldsky Base core subgraph: https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn
  3. Derive hash in renderer format: \x3CCollateral>-\x3CEyeShape>-\x3CEyeColor>-\x3CBody>-\x3CFace>-\x3CEyes>-\x3CHead>-\x3CLeftHand>-\x3CRightHand>-\x3CPet>
  4. Call POST https://www.aavegotchi.com/api/renderer/batch with:
  • verify: true
  • renderTypes: ["PNG_Full", "PNG_Headshot", "GLB_3DModel"]
  1. Download proxyUrls.PNG_Full and proxyUrls.PNG_Headshot.
  2. Return the hash, response, and saved artifact paths.

Command

Run the bundled script:

node scripts/render-gotchi-bypass.mjs --token-id 6741

Or pass an inventory URL:

node scripts/render-gotchi-bypass.mjs \
  --inventory-url "https://www.aavegotchi.com/u/0x.../inventory?itemType=aavegotchis&chainId=8453&id=6741"

Use --out-dir /tmp to control artifact location (default: /tmp).

Return format

Always return:

  1. tokenId
  2. hash
  3. /api/renderer/batch status and raw JSON
  4. PNG_Full and PNG_Headshot output paths (or missing reason)
  5. GLB_3DModel URL or availability.exists=false

Troubleshooting

  • If Goldsky returns no gotchi, verify tokenId and Base context.
  • If batch returns hash-format 400, verify eye mappings and left/right wearable order.
  • If availability.exists is false, rerun batch to trigger render and poll again.
  • If endpoint returns 404, verify production deployment state.
Usage Guidance
This skill appears internally coherent and implements what it says: it fetches a gotchi record from the Goldsky subgraph, derives a renderer hash, calls Aavegotchi's /api/renderer/batch, and saves returned artifacts to disk. Before installing or running, consider: 1) it will make network requests to the two endpoints embedded in the code and write files to your filesystem (default /tmp) — run in a sandbox or container if you want to limit exposure; 2) no credentials are requested, but ensure the endpoints are legitimate and you are comfortable contacting them from your environment; 3) review the script if you will run it in a long-lived or privileged environment — there's a minor implementation bug risk (address normalization in COLLATERAL_MAP may not match and could yield incorrect collateral detection), so validate outputs with a known tokenId first; and 4) expect normal operational risks (rate limits, 404/400 responses) when calling public APIs.
Capability Analysis
Type: OpenClaw Skill Name: aavegotchi-renderer-bypass Version: 0.1.0 The `scripts/render-gotchi-bypass.mjs` script allows a user-controlled output directory via the `--out-dir` argument. This argument is used directly in `fs.mkdirSync` and `path.join` to determine where files are written, creating a directory traversal vulnerability. An attacker could potentially write files to arbitrary locations on the filesystem (e.g., `../../../../etc/malicious.json`) by providing a crafted `--out-dir` value, which is a significant vulnerability, though not indicative of intentional malicious design by the skill developer.
Capability Assessment
✓ Purpose & Capability
The name/description claim (derive renderer hashes from Goldsky Base data and POST to /api/renderer/batch on www.aavegotchi.com) matches the included SKILL.md and the bundled script. The script queries the declared Goldsky endpoint, constructs a hash from returned gotchi fields, posts to the renderer batch API, and downloads artifacts — all expected for this purpose. No unrelated APIs, binaries, or credentials are requested.
✓ Instruction Scope
SKILL.md explicitly instructs to query the Goldsky subgraph, derive the renderer hash, call the renderer batch endpoint, and save JSON/PNG/GLB artifacts to disk. The script implements exactly those steps and does not attempt to read other system files, environment variables, or send data to unexpected third-party endpoints. It does write files to disk (default /tmp) and performs network requests to the two service endpoints described.
✓ Install Mechanism
There is no install specification — this is an instruction-only skill with a single included Node script. No downloads from arbitrary URLs, package installs, or extracted archives occur during install.
✓ Credentials
The skill declares no required environment variables, credentials, or config paths, and the script does not read any secrets or environment variables. All network calls go to the Goldsky subgraph endpoint and www.aavegotchi.com as described.
✓ Persistence & Privilege
The skill is not marked always:true and does not modify other skills or system-wide agent settings. It runs on demand and writes output only to a user-specified out-dir (default /tmp).
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install aavegotchi-renderer-bypass
  3. After installation, invoke the skill by name or use /aavegotchi-renderer-bypass
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release: renderer hash derivation and batch render/download workflow.
Metadata
Slug aavegotchi-renderer-bypass
Version 0.1.0
License —
All-time Installs 3
Active Installs 3
Total Versions 1
Frequently Asked Questions

What is Aavegotchi Renderer Bypass?

Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use... It is an AI Agent Skill for Claude Code / OpenClaw, with 545 downloads so far.

How do I install Aavegotchi Renderer Bypass?

Run "/install aavegotchi-renderer-bypass" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Aavegotchi Renderer Bypass free?

Yes, Aavegotchi Renderer Bypass is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Aavegotchi Renderer Bypass support?

Aavegotchi Renderer Bypass is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Aavegotchi Renderer Bypass?

It is built and maintained by cinnabarhorse (@cinnabarhorse); the current version is v0.1.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments