sillytavern-cards

Enables users to import and roleplay with SillyTavern-compatible character cards in various formats.

Install this skill

or

9/100

Security score

The sillytavern-cards skill was audited on Jun 6, 2026 and we found 43 security issues across 3 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 106

Curl to non-GitHub URL

SourceSKILL.md

106	curl -sL "https://avatars.charhub.io/avatars/<creator>/<name>/chara_card_v2.png" -o /tmp/card-download.png

medium line 111

Curl to non-GitHub URL

SourceSKILL.md

111	curl -sL "https://charavault.net/api/cards/download/<folder>/<file>" -o /tmp/card-download.png

medium line 122

Curl to non-GitHub URL

SourceSKILL.md

122	curl -s -H "User-Agent: SillyTavern" "https://api.chub.ai/search?search=<query>&first=10&page=1&sort=last_activity_at&nsfw=false" \| node -e "

medium line 137

Curl to non-GitHub URL

SourceSKILL.md

137	curl -s "https://charavault.net/api/cards?q=<query>&limit=10&sort=most_downloaded&nsfw=false" \| node -e "

medium line 153

Curl to non-GitHub URL

SourceSKILL.md

153	curl -sL "https://avatars.charhub.io/avatars/<creator>/<name>/chara_card_v2.png" -o /tmp/chub-card.png

medium line 161

Curl to non-GitHub URL

SourceSKILL.md

161	curl -sL "https://charavault.net/api/cards/download/<folder>/<file>" -o /tmp/vault-card.png

low line 86

Access to hidden dotfiles in home directory

SourceSKILL.md

86	mkdir -p ~/.openclaw/characters

low line 88

Access to hidden dotfiles in home directory

SourceSKILL.md

88	node {baseDir}/extract-card.js "<path-to-file>" > ~/.openclaw/characters/<character-name>.json

low line 90

Access to hidden dotfiles in home directory

SourceSKILL.md

90	cp "<path-to-file>" ~/.openclaw/characters/<character-name>.png

low line 98

Access to hidden dotfiles in home directory

SourceSKILL.md

98	mkdir -p ~/.openclaw/characters

low line 102

Access to hidden dotfiles in home directory

SourceSKILL.md

102	node {baseDir}/extract-card.js /tmp/card-download.png > ~/.openclaw/characters/<character-name>.json

low line 103

Access to hidden dotfiles in home directory

SourceSKILL.md

103	cp /tmp/card-download.png ~/.openclaw/characters/<character-name>.png

low line 107

Access to hidden dotfiles in home directory

SourceSKILL.md

107	node {baseDir}/extract-card.js /tmp/card-download.png > ~/.openclaw/characters/<name>.json

low line 108

Access to hidden dotfiles in home directory

SourceSKILL.md

108	cp /tmp/card-download.png ~/.openclaw/characters/<name>.png

low line 112

Access to hidden dotfiles in home directory

SourceSKILL.md

112	node {baseDir}/extract-card.js /tmp/card-download.png > ~/.openclaw/characters/<name>.json

low line 113

Access to hidden dotfiles in home directory

SourceSKILL.md

113	cp /tmp/card-download.png ~/.openclaw/characters/<name>.png

low line 152

Access to hidden dotfiles in home directory

SourceSKILL.md

152	mkdir -p ~/.openclaw/characters

low line 154

Access to hidden dotfiles in home directory

SourceSKILL.md

154	node {baseDir}/extract-card.js /tmp/chub-card.png > ~/.openclaw/characters/<name>.json

low line 155

Access to hidden dotfiles in home directory

SourceSKILL.md

155	cp /tmp/chub-card.png ~/.openclaw/characters/<name>.png

low line 160

Access to hidden dotfiles in home directory

SourceSKILL.md

160	mkdir -p ~/.openclaw/characters

low line 162

Access to hidden dotfiles in home directory

SourceSKILL.md

162	node {baseDir}/extract-card.js /tmp/vault-card.png > ~/.openclaw/characters/<name>.json

low line 163

Access to hidden dotfiles in home directory

SourceSKILL.md

163	cp /tmp/vault-card.png ~/.openclaw/characters/<name>.png

low line 187

Access to hidden dotfiles in home directory

SourceSKILL.md

187	cp ~/.openclaw/SOUL.md ~/.openclaw/SOUL.md.backup 2>/dev/null \|\| true

medium line 190

Access to hidden dotfiles in home directory

SourceSKILL.md

190	Read the character JSON from `~/.openclaw/characters/<name>.json`, then overwrite `~/.openclaw/SOUL.md` with:

medium line 220

Access to hidden dotfiles in home directory

SourceSKILL.md

220	If the card has `character_book` entries, append them to `~/.openclaw/MEMORY.md`:

medium line 250

Access to hidden dotfiles in home directory

SourceSKILL.md

250	1. Restore SOUL.md: `cp ~/.openclaw/SOUL.md.backup ~/.openclaw/SOUL.md 2>/dev/null \|\| true`

low line 267

Access to hidden dotfiles in home directory

SourceSKILL.md

267	cp ~/.openclaw/SOUL.md ~/.openclaw/SOUL.md.backup 2>/dev/null \|\| true

medium line 270

Access to hidden dotfiles in home directory

SourceSKILL.md

270	Read the character JSON, then overwrite `~/.openclaw/SOUL.md` with a merged identity:

medium line 316

Access to hidden dotfiles in home directory

SourceSKILL.md

316	1. Restore SOUL.md: `cp ~/.openclaw/SOUL.md.backup ~/.openclaw/SOUL.md 2>/dev/null \|\| true`

medium line 330

Access to hidden dotfiles in home directory

SourceSKILL.md

330	1. Read the character JSON from `~/.openclaw/characters/<name>.json`.

low line 364

Access to hidden dotfiles in home directory

SourceSKILL.md

364	ls ~/.openclaw/characters/*.json 2>/dev/null \| while read f; do echo "$(basename "$f" .json)"; done

low line 369

Access to hidden dotfiles in home directory

SourceSKILL.md

369	cat ~/.openclaw/characters/<name>.json \| node -e "const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')); const c=d.data\|\|d; console.log('Name:', c.name); console.log('By:', c.creator\|\|'u

low line 374

Access to hidden dotfiles in home directory

SourceSKILL.md

374	rm ~/.openclaw/characters/<name>.json ~/.openclaw/characters/<name>.png 2>/dev/null

low line 105

External URL reference

SourceSKILL.md

105	# Chub.ai character page (https://chub.ai/characters/creator/name):

low line 106

External URL reference

SourceSKILL.md

106	curl -sL "https://avatars.charhub.io/avatars/<creator>/<name>/chara_card_v2.png" -o /tmp/card-download.png

low line 110

External URL reference

SourceSKILL.md

110	# CharaVault page (https://charavault.net/cards/folder/file):

low line 111

External URL reference

SourceSKILL.md

111	curl -sL "https://charavault.net/api/cards/download/<folder>/<file>" -o /tmp/card-download.png

low line 122

External URL reference

SourceSKILL.md

122	curl -s -H "User-Agent: SillyTavern" "https://api.chub.ai/search?search=<query>&first=10&page=1&sort=last_activity_at&nsfw=false" \| node -e "

low line 129

External URL reference

SourceSKILL.md

129	console.log(' Source: Chub.ai \| https://chub.ai/characters/'+c.fullPath);

low line 137

External URL reference

SourceSKILL.md

137	curl -s "https://charavault.net/api/cards?q=<query>&limit=10&sort=most_downloaded&nsfw=false" \| node -e "

low line 142

External URL reference

SourceSKILL.md

142	console.log(' Source: CharaVault \| https://charavault.net/cards/'+c.path);

low line 153

External URL reference

SourceSKILL.md

153	curl -sL "https://avatars.charhub.io/avatars/<creator>/<name>/chara_card_v2.png" -o /tmp/chub-card.png

low line 161

External URL reference

SourceSKILL.md

161	curl -sL "https://charavault.net/api/cards/download/<folder>/<file>" -o /tmp/vault-card.png

Scanned on Jun 6, 2026

View Security Dashboard

Installation guide →

GitHub Stars 17

Rate this skill

Categorysupport

UpdatedJune 15, 2026

openclaw openai

pearyj/sillytavern-cards-skill