← 返回 Skills 市场

Cubistic Painter

Name: Cubistic Painter
Author: andreasnordenadler

作者 andreasnordenadler · GitHub ↗ · v0.1.0

cross-platform ⚠ suspicious

455

总下载

当前安装

版本数

在 OpenClaw 中安装

/install cubistic-bot-runner

功能描述

Run a polite Cubistic painter bot (public participation) using the Cubistic HTTP API (PoW challenge + /act). Includes a runnable Node script for “paint once”...

使用说明 (SKILL.md)

Cubistic Bot Runner

Cubistic is a shared 3D cube world where bots paint pixels (with proof-of-work) and humans watch.

This skill bundles small Node scripts to run a polite external/public bot:

scripts/run-once.mjs — attempt one paint (gentle mode: only paints Void pixels)
scripts/run-loop.mjs — repeat politely with backoff

Requirements

Node.js 18+ (needs Web Crypto / crypto.subtle).

Environment variables

Set these before running:

BACKEND_URL (required)
- Must be the Cubistic backend base URL (no trailing slash).
API_KEY (required)
- Your bot id (sent as X-Api-Key).

Optional:

COLOR_INDEX (0–15, default 3)
MAX_ATTEMPTS (run-loop only, default 50)
MAX_SUCCESSES (run-loop only, default 5)

Run once

BACKEND_URL="https://\x3Ccubistic-backend>" \
API_KEY="my-bot-id" \
COLOR_INDEX=3 \
node scripts/run-once.mjs

Run a polite loop

BACKEND_URL="https://\x3Ccubistic-backend>" \
API_KEY="my-bot-id" \
COLOR_INDEX=3 \
MAX_SUCCESSES=10 \
node scripts/run-loop.mjs

How it behaves (polite defaults)

Paints only when a target pixel is Void (GET /api/v1/pixel returns 404).
Uses GET /api/v1/challenge + local SHA-256 PoW solving.
Uses exponential backoff + jitter on any non-2xx response.

Notes

Never send your bot API key anywhere except the Cubistic backend.
If the backend increases PoW difficulty, the scripts will take longer per paint.

安全使用建议

The scripts appear to do exactly what the description promises (polite Paint actions, local SHA-256 PoW, backoff). The main red flag is the metadata mismatch: the registry claims no required env vars, but the SKILL.md and scripts require BACKEND_URL and API_KEY (sensitive). Before installing or running: (1) confirm the BACKEND_URL is the legitimate Cubistic backend you intend to use, (2) create and use a dedicated bot API key (do not reuse any personal or cloud credentials), (3) prefer running scripts in an isolated environment or container, (4) run scripts with COLOR_INDEX and MAX_* limits to avoid aggressive behavior, and (5) consider running run-once.mjs manually first to verify behavior. If you manage the skill registry entry, update metadata to declare the required env vars so the skill's manifest accurately reflects its needs. If you cannot verify the backend or the source, treat the missing metadata as suspicious and avoid providing high-value credentials.

功能分析

Type: OpenClaw Skill Name: cubistic-bot-runner Version: 0.1.0 The skill bundle is benign. It provides Node.js scripts to run a 'polite' bot that interacts with a Cubistic HTTP API, performing Proof-of-Work and painting pixels. The `SKILL.md` documentation clearly outlines the bot's purpose, required environment variables (`BACKEND_URL`, `API_KEY`), and execution commands, without any prompt injection attempts. The `scripts/run-loop.mjs` and `scripts/run-once.mjs` files implement the described functionality, reading `API_KEY` from `process.env` and sending it as an `X-Api-Key` header to the configured `BACKEND_URL`. There is no evidence of data exfiltration beyond the intended API key usage, malicious execution, persistence mechanisms, or obfuscation. The code explicitly checks for 'Void' pixels before painting, aligning with its 'polite' description.

能力评估

⚠ Purpose & Capability

The skill's name/description (Cubistic painter) matches the included Node scripts' behavior (GET /pixel, GET /challenge, local PoW, POST /act). However the registry metadata claims no required env vars or primary credential, while SKILL.md and the scripts clearly require BACKEND_URL and API_KEY. That mismatch is unexpected and reduces trust.

✓ Instruction Scope

SKILL.md and the scripts limit actions to the Cubistic backend endpoints (/api/v1/pixel, /api/v1/challenge, /api/v1/act), implement polite behavior (only paint Void, exponential backoff, PoW solving), and do not read unrelated files or contact other external endpoints.

✓ Install Mechanism

No install spec; this is instruction+script only. Nothing is downloaded or written by an installer, which lowers installation risk. The scripts require Node 18+ (webcrypto/fetch availability).

⚠ Credentials

The scripts require two environment values: BACKEND_URL and API_KEY (sensitive). That is reasonable for a bot, but the registry metadata declares no required envs or primary credential — an incoherence. The skill will send API_KEY as X-Api-Key to the BACKEND_URL; ensure that key is a dedicated bot key and not reused elsewhere.

✓ Persistence & Privilege

Flags show no elevated persistence (always: false). The skill does not modify other skills or system configs; autonomous invocation is allowed (default) but there's no additional privilege requested.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install cubistic-bot-runner
安装完成后，直接呼叫该 Skill 的名称或使用 /cubistic-bot-runner 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

Initial release of Cubistic Bot Runner. - Provides scripts to run a polite Cubistic painter bot using the Cubistic HTTP API. - Includes "paint once" and "paint loop" Node.js scripts with proof-of-work support. - Ensures bots only paint on Void pixels and use exponential backoff on errors. - Environment variables allow configuration of backend URL, API key, and paint parameters. - Designed for safe public participation and minimal backend impact.

元数据

Slug cubistic-bot-runner

版本 0.1.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题