OpenClaw Buddy

Generate a unique deterministic virtual pet buddy based on your user ID, featuring species, rarity, stats, cosmetics, and personality in ASCII art format.

This skill appears coherent and low-risk: it deterministically generates a virtual pet from a user ID using the included JS file and does not request credentials or network access. Before installing, verify two simple points: (1) ensure the agent environment has Node.js available (the SKILL.md instructs running node but metadata didn't declare Node as a required binary), and (2) inspect the remainder of scripts/buddy.js (the provided snippet was truncated) to confirm there are no unexpected network calls, child_process.exec/spawn usage, or filesystem operations. Also consider the privacy implication of letting users supply arbitrary IDs (the skill allows checking other people's IDs) — decide whether you want to restrict that behavior in your deployment. If Node is not present or you cannot inspect the full file, treat the Node requirement / truncated file as an installation blocker.

Type: OpenClaw Skill Name: openclaw-buddy Version: 1.0.0 The skill implements a virtual pet generator using deterministic hashing and a PRNG. While the logic in `scripts/buddy.js` is benign, the `SKILL.md` instructions introduce a shell injection vulnerability by directing the AI agent to execute a command-line script using a potentially user-controlled `<user_id>` string without any input sanitization. This allows for arbitrary command execution if a user provides a crafted ID containing shell metacharacters.