← 返回 Skills 市场

Aavegotchi 3D Renderer

Name: Aavegotchi 3D Renderer
Author: cinnabarhorse

作者 cinnabarhorse · GitHub ↗ · v0.1.2

cross-platform ⚠ suspicious

556

总下载

当前安装

版本数

在 OpenClaw 中安装

/install aavegotchi-3d-renderer

功能描述

Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use...

使用说明 (SKILL.md)

Aavegotchi 3D Renderer

Render gotchi assets from token data and renderer batch APIs.

Inputs

Accept either tokenId or inventory URL with id=\x3CtokenId>.
Target Base by default (chainId=8453).

Outputs

Return derived renderer hash.
Return /api/renderer/batch HTTP status.
Save raw batch JSON to disk.
Save PNG_Full and PNG_Headshot to disk when available.
Return GLB_3DModel availability and URL when present.

Execute

Extract tokenId from direct input or inventory URL.
Query Goldsky Base core subgraph: https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn
Derive hash in renderer format: \x3CCollateral>-\x3CEyeShape>-\x3CEyeColor>-\x3CBody>-\x3CFace>-\x3CEyes>-\x3CHead>-\x3CRightHand>-\x3CLeftHand>-\x3CPet>
Kick off render with POST https://www.aavegotchi.com/api/renderer/batch using:

force: true
verify: false
renderTypes: ["PNG_Full", "PNG_Headshot", "GLB_3DModel"]

Poll POST /api/renderer/batch with verify: true until availability.exists=true for all requested render types or timeout.
Download proxyUrls.PNG_Full and proxyUrls.PNG_Headshot only when corresponding availability.exists=true.
Return the hash, kickoff + verify responses, poll summary, and saved artifact paths.

Command

Run the bundled script:

node scripts/render-gotchi-bypass.mjs --token-id 6741

Or pass an inventory URL:

node scripts/render-gotchi-bypass.mjs \
  --inventory-url "https://www.aavegotchi.com/u/0x.../inventory?itemType=aavegotchis&chainId=8453&id=6741"

Use --out-dir /tmp to control artifact location (default: /tmp).

Optional polling controls:

--poll-attempts 18 --poll-interval-ms 10000

Return format

Always return:

tokenId
hash
Kickoff status, verify status, and raw JSON paths
Poll summary (pollAttempts, pollIntervalMs, renderReady)
PNG_Full and PNG_Headshot output paths (or missing reason)
GLB_3DModel availability and URL when present

Troubleshooting

If Goldsky returns no gotchi, verify tokenId and Base context.
If batch returns hash-format 400, verify eye mappings and right/left wearable order (index4 then index5).
If availability.exists is false, ensure kickoff used force:true, then keep polling verify:true until timeout.
If endpoint returns 404, verify production deployment state.

安全使用建议

This skill appears to do what it says: it queries Goldsky and Aavegotchi APIs, derives a renderer hash, starts/polls renders, and writes artifacts to disk. Before running, note: (1) you need Node.js to execute the bundled script (the metadata omits this requirement); Node 18+ is recommended because the script uses global fetch; (2) the script will make network requests to external services (https://api.goldsky.com and https://www.aavegotchi.com) and will save JSON and image/GLB files (default /tmp) — run it in a controlled environment if you are concerned about disk writes or network traffic; (3) review the script source yourself (it is bundled) if you have any trust concerns. No credentials are requested or transmitted by the skill.

功能分析

Type: OpenClaw Skill Name: aavegotchi-3d-renderer Version: 0.1.2 The skill is classified as suspicious due to the presence of an arbitrary file write vulnerability and a potential supply chain risk. The `scripts/render-gotchi-bypass.mjs` script allows users to specify an output directory via the `--out-dir` argument, which defaults to `/tmp` but can be set to any path. This enables writing JSON and PNG files to arbitrary locations on the file system, posing a risk if a malicious path (e.g., `/etc/cron.d`, `~/.ssh`) is provided. Additionally, the script downloads image artifacts from `proxyUrls` provided by the `www.aavegotchi.com` API. While the base URL is hardcoded, a compromise of the `www.aavegotchi.com` API could lead to the agent downloading malicious content from attacker-controlled URLs.

能力评估

ℹ Purpose & Capability

The skill is described as a renderer helper and its code performs exactly that: query Goldsky subgraph, derive a renderer hash, POST to Aavegotchi's /api/renderer/batch, poll, and download artifacts. One minor incoherence: SKILL.md and README instruct running the bundled Node script (node scripts/render-gotchi-bypass.mjs) but the registry metadata lists no required binaries — the runtime implicitly requires a Node.js environment (and likely Node 18+ for global fetch). This is a documentation/metadata omission, not evidence of malicious intent.

✓ Instruction Scope

The runtime instructions are narrowly scoped to the stated task: extract tokenId, query a Goldsky subgraph, derive a hash, kick off and verify renders via Aavegotchi's renderer API, poll until availability, and download specified artifacts. The instructions do not request unrelated files, credentials, or unexpected external endpoints.

ℹ Install Mechanism

There is no install spec (instruction-only with a bundled script). That is low risk, but the bundled script will be executed directly by Node — there is no packaged/verified install step. The script embeds the Goldsky and Aavegotchi endpoints but does not fetch or execute code from arbitrary third-party URLs. Users should be aware the script writes files to disk (default /tmp).

✓ Credentials

The skill declares no environment variables or credentials and the code does not attempt to read secrets. Network access is required to the Goldsky subgraph and aavegotchi.com renderer API, which is appropriate for the stated function.

✓ Persistence & Privilege

always is false and the skill does not request persistent platform privileges. It only writes output artifacts to a configurable out-dir (default /tmp) and does not attempt to modify other skills or system configuration.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install aavegotchi-3d-renderer
安装完成后，直接呼叫该 Skill 的名称或使用 /aavegotchi-3d-renderer 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.2

Release 0.1.2: force renderer kickoff (force:true, verify:false), add verify polling, and return clear availability/missing reasons for artifacts.

v0.1.1

Release 0.1.1: fix renderer hash hand-slot order (RightHand then LeftHand) to prevent 403 asset misses for valid gotchis.

v0.1.0

Set canonical skill name to aavegotchi-3d-renderer.

元数据

Slug aavegotchi-3d-renderer

版本 0.1.2

许可证 —

累计安装 3

当前安装数 3

历史版本数 3

常见问题