← Back to Skills Marketplace
jpaulgrayson

Agent Postcard

by JPaulGrayson · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
452
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install agent-postcard
Description
Generate and send AI-created postcards featuring your agent's selfie at real locations in 12 distinct artistic styles via the Turai Postcard API.
README (SKILL.md)

Agent Postcard

Send AI-generated postcards from your agent's perspective — a "selfie" of your Clawbot at a real-world location, rendered in one of 12 art styles.

Concept

Your agent reads its own persona (from SOUL.md or IDENTITY.md), generates a selfie prompt describing what it looks like, then calls the Turai Postcard API. Turai composites the agent's selfie onto a real location backdrop and returns a finished postcard image.

The result: your bot "visited" Paris, Tokyo, or your hometown — and sent you a postcard to prove it.

Art Styles

Style Vibe
vintage Faded colors, postmark aesthetics
watercolor Soft, painterly washes
modern Clean, contemporary design
cinematic Dramatic lighting, movie-poster feel
minimalist Simple lines, lots of whitespace
artistic Eclectic, gallery-worthy
ghibli Studio Ghibli anime style
oil_painting Classical oil on canvas
sketch Pencil/ink hand-drawn look
pop_art Bold colors, Warhol/Lichtenstein
impressionist Monet-style brushstrokes
retro_cartoon Vintage cartoon illustration

Setup

  1. Get a Turai API key from turai.org
  2. Set the environment variable:
    export TURAI_API_KEY="your-key-here"
    

Usage

From the command line

# Basic — agent selfie in Tokyo, vintage style
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Tokyo, Japan" \
  --style vintage \
  --message "Wish you were here!"

# Auto-read persona from SOUL.md (default behavior)
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Paris, France" \
  --style ghibli

# Custom selfie prompt (skip persona auto-detection)
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "New York City" \
  --style pop_art \
  --selfie "A friendly robot with glowing blue eyes wearing a Yankees cap" \
  --message "Greetings from the Big Apple!"

# Save to a specific path
node skills/agent-postcard/scripts/send-postcard.mjs \
  --location "Iceland" \
  --style watercolor \
  --output ./my-postcard.png

From your agent

Tell your agent something like:

"Send me a postcard from Rome in oil painting style"

The agent should:

  1. Read its own persona to build a selfie prompt
  2. Run the script with the right flags
  3. Send the resulting image via chat or Moltbook

API Reference

Endpoint: POST https://turai.org/api/agent/postcard

Headers:

  • x-api-key: Your Turai API key
  • Content-Type: application/json

Body:

{
  "selfiePrompt": "A cheerful robot with antenna ears...",
  "location": "Paris, France",
  "style": "vintage",
  "message": "Wish you were here!"
}

Response: Image binary (PNG) or JSON with image URL.

Files

  • SKILL.md — This file
  • scripts/send-postcard.mjs — Main script
Usage Guidance
This skill appears to do what it says (create and download postcards), but there are important issues to consider before installing or using it: - Metadata mismatch: The registry metadata does not list TURAI_API_KEY or OPENCLAW_WORKSPACE even though the script and SKILL.md require TURAI_API_KEY and the script reads OPENCLAW_WORKSPACE. Confirm the skill's declared requirements before providing credentials. - Persona privacy / data exfiltration: By default the agent will read SOUL.md or IDENTITY.md (and ../SOUL.md) and include extracted persona text in the request body sent to turai.org. If those files contain personal, proprietary, or sensitive information, that content will be transmitted to an external service. Consider removing or sanitizing persona files or running the skill in a controlled environment. - Trust the API endpoint: The skill sends data to https://turai.org. Only supply your TURAI_API_KEY to this skill if you trust that service and the key's permissions. Consider creating a scoped or expendable key for testing. - Path scope: The script will search parent directories; if you need to restrict file access, run the script from a sandboxed workspace or pass an explicit --selfie prompt to avoid auto-reading persona files. - Suggested mitigations: Update registry metadata to declare TURAI_API_KEY as a required credential; document OPENCLAW_WORKSPACE; add a clear consent prompt before sending persona content; or change the script to redact or summarize persona text locally rather than sending raw content. If you cannot validate the upstream service or update the code, run the script only in an isolated environment and avoid exposing sensitive persona files or production API keys.
Capability Analysis
Type: OpenClaw Skill Name: agent-postcard Version: 1.0.0 The skill is classified as suspicious due to a potential arbitrary file write vulnerability. The `scripts/send-postcard.mjs` script allows users to specify an arbitrary output path for the generated image via the `--output` flag. This could be exploited to overwrite sensitive system files or user configuration files with a PNG image, leading to denial of service or system instability. While the skill's core functionality (generating postcards via an external API) appears benign, this file system access vulnerability elevates the risk.
Capability Assessment
Purpose & Capability
The name/description match the included script: it calls a Turai postcard API to generate and download an image. However the registry metadata claims no required environment variables or primary credential, while both SKILL.md and the script clearly require a TURAI_API_KEY. This metadata omission is an inconsistency.
Instruction Scope
The SKILL.md and script instruct the agent to auto-read persona files (SOUL.md / IDENTITY.md, and even ../SOUL.md) and embed extracted persona text into the selfiePrompt sent to https://turai.org. That means local persona content (which may contain private or identifying information) is transmitted to a third party without any granular consent or redaction. The script will also accept an explicit --persona path or default to parent directory, enabling reading outside the workspace.
Install Mechanism
No install spec or third‑party package downloads are present; this is an instruction/script-only skill and does not write additional code to disk during install, which is low-risk from an install mechanism perspective.
Credentials
The skill requires a Turai API key at runtime (TURAI_API_KEY) but the registry metadata declares no required env vars or primary credential — a mismatch that could mislead users. The script also respects OPENCLAW_WORKSPACE (not documented in SKILL.md), which affects where it looks for persona files. Requesting an external API key is proportionate to the advertised purpose, but the undocumented/missing env-var declarations and the reading/transmission of local persona files are problematic.
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify other skills or global agent settings, and has no install hook. It does not request elevated privileges beyond reading files in the workspace and parent directory.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install agent-postcard
  3. After installation, invoke the skill by name or use /agent-postcard
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Slug agent-postcard
Version 1.0.0
License
All-time Installs 1
Active Installs 1
Total Versions 1
Frequently Asked Questions

What is Agent Postcard?

Generate and send AI-created postcards featuring your agent's selfie at real locations in 12 distinct artistic styles via the Turai Postcard API. It is an AI Agent Skill for Claude Code / OpenClaw, with 452 downloads so far.

How do I install Agent Postcard?

Run "/install agent-postcard" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Agent Postcard free?

Yes, Agent Postcard is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Agent Postcard support?

Agent Postcard is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Agent Postcard?

It is built and maintained by JPaulGrayson (@jpaulgrayson); the current version is v1.0.0.

💬 Comments