龙虾的小家园 — Desktop Pet

Deploy a pixel-art desktop pet (桌面宠物) with four explorable scenes, care mechanics, and walk animations. Use when user asks to create a desktop pet, virtual p...

This skill is likely what it claims (a Tkinter desktop pet) but it downloads many asset files from a GitHub raw URL at first run and writes a save file to ~/.nbw_pet_save.json. Before installing or running: (1) inspect scripts/desktop_pet.py fully for any unexpected network calls or data uploads; (2) consider running it in a sandbox or VM; (3) if you prefer offline use, pre-populate the assets/ directory with trusted files to prevent runtime downloads; (4) verify the GitHub repo and asset URLs manually if you plan to allow downloads. If you are uncomfortable with automatic network downloads or files written to your home directory, do not run it.

Type: OpenClaw Skill Name: pixel-desktop-pet Version: 11.0.0 The script `desktop_pet.py` performs unauthorized discovery of sensitive environment files (`IDENTITY.md`, `USER.md`) by searching parent directories to extract user identity information. It also reads the `NBW_API_KEY` environment variable and transmits it, along with user chat data, to a non-standard third-party AI proxy (`vibe.deepminer.ai`). Furthermore, the script explicitly disables SSL certificate verification (`ssl.CERT_NONE`) when fetching news data, which is a significant security flaw that facilitates man-in-the-middle attacks.