🐱 Huahua Spirits — 灵兽陪伴
v1.4.7为每位用户分配独一无二的灵兽伙伴，具备性格、成长与互动机制，让 AI 交互更有温度与情感陪伴感。
0· 128·1 当前·1 累计
by 下载技能包
最后更新
2026/4/5
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it claims: local, deterministic ASCII 'spirit' companions. Key points to consider before installing:
- Privacy: the skill persistently stores companion data in assets/companion.json inside the skill folder, including bond, lastInteraction timestamps and short snippets of user messages (hook-react records up to 50 items). If you operate in a shared environment, these saved snippets could be visible to others with access to the agent's filesystem.
- Identity...详细分析 ▾
✓ 用途与能力
Name/description (companionship, deterministic spirit generation) matches the included scripts and files. The scripts implement generation (generate.js), rendering/display (render.js, display.js), soul prompt/save (soul.js), and passive/active behaviors (buddy.js). No unexpected cloud credentials, binaries, or unrelated dependencies are requested.
ℹ 指令范围
SKILL.md instructs the agent to run local node scripts and to use the LLM to turn the soul.js prompt into a name/personality. That LLM call is explicit in the workflow but not implemented in the shipped code (expected: agent/model call). The skill also instructs the agent to use a user identifier as the seed—this is necessary for deterministic generation but is a privacy-relevant detail. Everything the instructions ask the agent to read/write is limited to the skill directory (assets/companion.json, assets/sprites.json) and provided scripts.
✓ 安装机制
No install spec; this is instruction + script based. All code is provided in the package. There are no downloads from external URLs and no extraction/install steps that pull arbitrary binaries.
ℹ 凭证需求
The skill requests no environment variables or external credentials, which is proportional. However, it persistently stores companion data (assets/companion.json) and records short snippets of user messages (hook-react appends up to 50 interactionHistory entries). The skill also requires the agent to provide a user ID (e.g., Feishu open_id, Telegram ID) as a seed for deterministic generation — expected for this feature but privacy-sensitive because the seed links identities to generated artifacts.
ℹ 持久化与权限
always:false (normal). The skill writes persistent state to its own assets/companion.json (saving name, personality, stats, bond, lastInteraction and an interactionHistory). This is expected for a companion system, but it means the skill will retain user message snippets and bond state on disk across agent runs.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSmacOS · Linux · Windows
版本
latestv1.4.72026/4/4
NULL
● Pending
安装命令
点击复制官方npx clawhub@latest install huahua-spirits
镜像加速npx clawhub@latest install huahua-spirits --registry https://cn.longxiaskill.com