Clawcap Avatar Equip

AI-powered avatar accessory synthesis — automatically analyzes art style, lighting, and angle to seamlessly add hats and headwear to any avatar image.

This skill appears to implement what it claims, but take these precautions before installing or using it: - Expect to set GEMINI_API_KEY (the registry metadata omitted this); do not supply broader credentials than necessary. - Prefer running locally in an isolated environment (container or VM) rather than using the authors' demo site (http://107.172.78.150:8000) to avoid sending images to a third party. - Be cautious if you allow image_url inputs: the service will fetch arbitrary URLs (SSRF risk). If deploying internally, restrict outbound/network access and/or validate/whitelist hostnames. - Review the GitHub repository and commit history yourself (link provided in docs) and confirm there are no hidden telemetry or unexpected network calls beyond google-genai and standard HTTP image fetches. - Monitor usage/billing on your Gemini API key and rotate/revoke it if you suspect misuse. If you want, I can list the exact lines where GEMINI_API_KEY is referenced and point out the places you should harden (host whitelisting, input validation, demo link removal).

Type: OpenClaw Skill Name: the-clawcap Version: 0.1.0 The ClawCap is a legitimate image processing skill that uses Google's Gemini AI to add accessories (like lobster hats) to avatar images. While the documentation and UI (static/index.html) use edgy, thematic language related to 'brain control' and 'infection,' the actual code logic in core/inpainter.py and core/vision_fingerprint.py is focused entirely on image analysis and generation. The skill includes standard safety filters (BANNED_PATTERN in api/routes.py) and follows proper MCP server implementation patterns without any evidence of data exfiltration or unauthorized execution.