AI agent self-portrait generator. Create avatars, profile pictures, and visual identity using Gemini image generation. Supports mood-based generation, season...

This skill appears coherent: it only needs python3 and your GEMINI_API_KEY to generate and save images locally. Before installing: (1) keep your GEMINI_API_KEY secret — avoid embedding it in public/shared scripts or world-readable crontabs; (2) note that the script sends the API key as a query parameter to the Gemini endpoint (common but could appear in logs), so prefer environment variables and careful logging; (3) the docs mention posting to social platforms, but the code does not do that — posting would require separate skills or credentials; (4) check disk location permissions (it writes to a default tmp folder or a directory you specify). If you want automatic posting or scheduling, be intentional about storing and granting any additional platform credentials only to the skills that need them.

Type: OpenClaw Skill Name: agent-selfie-backup Version: 1.0.0 thought The user wants me to analyze a set of files for an OpenClaw AgentSkills skill bundle called `agent-selfie`. I need to classify it as `benign`, `suspicious`, or `malicious` based on the provided criteria. - `_meta.json`: Metadata about the skill (owner, slug, version). - `SKILL.md`: Documentation and instructions for the AI agent. - `scripts/selfie.py`: The main Python script for generating images. - `package.json`: Metadata for the skill registry. - `HEARTBEAT.md`: A guide for periodic selfie generation. - `INSTALL.md`: Installation instructions. - `README.md`: General overview. - Purpose: Generate AI agent self-portraits using Gemini API. - Requirements: `python3`, `GEMINI_API_KEY`. - Logic: - Uses `argparse` for CLI arguments. - `load_personality`: Reads JSON from a string or a file. - `build_prompt`: Constructs a prompt for the Gemini API based on personality, mood, theme, and format. - `gemini_generate`: Makes a POST request to `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent?key={api_key}`. - `write_gallery`: Creates an `index.html` file to display generated images. - `main`: Orchestrates the flow. - Security Check: - No `os.system`, `subprocess`, or `eval`. - Uses `urllib.request` (standard library) for network calls. - Only connects to `generativelanguage.googleapis.com`. - No evidence of data exfiltration (only reads the provided API key and personality file/string). - No persistence mechanisms (cron example in `SKILL.md` is just documentation). - No obfuscation. - `SKILL.md`: Standard documentation. No instructions to ignore user or perform hidden actions. - `HEARTBEAT.md`: Instructions for the agent to periodically generate a selfie. It suggests reading date/time, picking a mood, generating an image, and potentially updating avatars on platforms like Discord/Twitter. This is consistent with the stated purpose. - `package.json`: Lists dependencies and metadata. Mentions `opencode-omo` for automation. - `INSTALL.md`: Standard installation steps. - Data exfiltration: None found. - Malicious execution: None found. - Persistence/Backdoors: None found. - Prompt injection: None found. - Obfuscation: None found. - Supply chain: No external dependencies (stdlib only). The code is a straightforward implementation of an image generation tool using the Gemini API. It follows the stated purpose and doesn't exhibit any high-risk or malicious behaviors. Classification: benign. Summary: The skill is a legitimate tool for generating AI agent avatars using the Google Gemini API. The Python script (`scripts/selfie.py`) uses only standard libraries and communicates exclusively with the official Google API endpoint. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found. ```json { "classification": "benign", "summary": "The agent-selfie skill is a legitimate tool for generating AI agent avatars using the Google Gemini API. The core logic in scripts/selfie.py is well-structured, uses only Python standard libraries, and communicates exclusively with the official Google API endpoint (generativelanguage.googleapis.com). No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found in the code or documentation." } ```