← 返回 Skills 市场

Aavegotchi Renderer Bypass

Name: Aavegotchi Renderer Bypass
Author: cinnabarhorse

作者 cinnabarhorse · GitHub ↗ · v0.1.0

cross-platform ⚠ suspicious

545

总下载

当前安装

版本数

在 OpenClaw 中安装

/install aavegotchi-renderer-bypass

功能描述

Render Aavegotchi assets by deriving renderer hashes from Goldsky Base core data and calling POST /api/renderer/batch on www.aavegotchi.com. Use when the use...

使用说明 (SKILL.md)

Aavegotchi Renderer Bypass

Render gotchi assets from token data and renderer batch APIs.

Inputs

Accept either tokenId or inventory URL with id=\x3CtokenId>.
Target Base by default (chainId=8453).

Outputs

Return derived renderer hash.
Return /api/renderer/batch HTTP status.
Save raw batch JSON to disk.
Save PNG_Full and PNG_Headshot to disk when available.
Return GLB_3DModel availability and URL when present.

Execute

Extract tokenId from direct input or inventory URL.
Query Goldsky Base core subgraph: https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn
Derive hash in renderer format: \x3CCollateral>-\x3CEyeShape>-\x3CEyeColor>-\x3CBody>-\x3CFace>-\x3CEyes>-\x3CHead>-\x3CLeftHand>-\x3CRightHand>-\x3CPet>
Call POST https://www.aavegotchi.com/api/renderer/batch with:

verify: true
renderTypes: ["PNG_Full", "PNG_Headshot", "GLB_3DModel"]

Download proxyUrls.PNG_Full and proxyUrls.PNG_Headshot.
Return the hash, response, and saved artifact paths.

Command

Run the bundled script:

node scripts/render-gotchi-bypass.mjs --token-id 6741

Or pass an inventory URL:

node scripts/render-gotchi-bypass.mjs \
  --inventory-url "https://www.aavegotchi.com/u/0x.../inventory?itemType=aavegotchis&chainId=8453&id=6741"

Use --out-dir /tmp to control artifact location (default: /tmp).

Return format

Always return:

tokenId
hash
/api/renderer/batch status and raw JSON
PNG_Full and PNG_Headshot output paths (or missing reason)
GLB_3DModel URL or availability.exists=false

Troubleshooting

If Goldsky returns no gotchi, verify tokenId and Base context.
If batch returns hash-format 400, verify eye mappings and left/right wearable order.
If availability.exists is false, rerun batch to trigger render and poll again.
If endpoint returns 404, verify production deployment state.

安全使用建议

This skill appears internally coherent and implements what it says: it fetches a gotchi record from the Goldsky subgraph, derives a renderer hash, calls Aavegotchi's /api/renderer/batch, and saves returned artifacts to disk. Before installing or running, consider: 1) it will make network requests to the two endpoints embedded in the code and write files to your filesystem (default /tmp) — run in a sandbox or container if you want to limit exposure; 2) no credentials are requested, but ensure the endpoints are legitimate and you are comfortable contacting them from your environment; 3) review the script if you will run it in a long-lived or privileged environment — there's a minor implementation bug risk (address normalization in COLLATERAL_MAP may not match and could yield incorrect collateral detection), so validate outputs with a known tokenId first; and 4) expect normal operational risks (rate limits, 404/400 responses) when calling public APIs.

功能分析

Type: OpenClaw Skill Name: aavegotchi-renderer-bypass Version: 0.1.0 The `scripts/render-gotchi-bypass.mjs` script allows a user-controlled output directory via the `--out-dir` argument. This argument is used directly in `fs.mkdirSync` and `path.join` to determine where files are written, creating a directory traversal vulnerability. An attacker could potentially write files to arbitrary locations on the filesystem (e.g., `../../../../etc/malicious.json`) by providing a crafted `--out-dir` value, which is a significant vulnerability, though not indicative of intentional malicious design by the skill developer.

能力评估

✓ Purpose & Capability

The name/description claim (derive renderer hashes from Goldsky Base data and POST to /api/renderer/batch on www.aavegotchi.com) matches the included SKILL.md and the bundled script. The script queries the declared Goldsky endpoint, constructs a hash from returned gotchi fields, posts to the renderer batch API, and downloads artifacts — all expected for this purpose. No unrelated APIs, binaries, or credentials are requested.

✓ Instruction Scope

SKILL.md explicitly instructs to query the Goldsky subgraph, derive the renderer hash, call the renderer batch endpoint, and save JSON/PNG/GLB artifacts to disk. The script implements exactly those steps and does not attempt to read other system files, environment variables, or send data to unexpected third-party endpoints. It does write files to disk (default /tmp) and performs network requests to the two service endpoints described.

✓ Install Mechanism

There is no install specification — this is an instruction-only skill with a single included Node script. No downloads from arbitrary URLs, package installs, or extracted archives occur during install.

✓ Credentials

The skill declares no required environment variables, credentials, or config paths, and the script does not read any secrets or environment variables. All network calls go to the Goldsky subgraph endpoint and www.aavegotchi.com as described.

✓ Persistence & Privilege

The skill is not marked always:true and does not modify other skills or system-wide agent settings. It runs on demand and writes output only to a user-specified out-dir (default /tmp).

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install aavegotchi-renderer-bypass
安装完成后，直接呼叫该 Skill 的名称或使用 /aavegotchi-renderer-bypass 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

Initial release: renderer hash derivation and batch render/download workflow.

元数据

Slug aavegotchi-renderer-bypass

版本 0.1.0

许可证 —

累计安装 3

当前安装数 3

历史版本数 1

常见问题