# Send Quotly Style Sticker to your agent
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
## Fast path
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
## Suggested prompts
### New install

```text
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
```
### Upgrade existing

```text
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
```
## Machine-readable fields
```json
{
  "schemaVersion": "1.0",
  "item": {
    "slug": "quotly-style-sticker",
    "name": "Quotly Style Sticker",
    "source": "tencent",
    "type": "skill",
    "category": "通讯协作",
    "sourceUrl": "https://clawhub.ai/sakullla/quotly-style-sticker",
    "canonicalUrl": "https://clawhub.ai/sakullla/quotly-style-sticker",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadUrl": "/downloads/quotly-style-sticker",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=quotly-style-sticker",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "packageFormat": "ZIP package",
    "primaryDoc": "SKILL.md",
    "includedAssets": [
      "agents/openai.yaml",
      "scripts/input.sample.json",
      "scripts/openclaw_quote_autoreply.py",
      "SKILL.md"
    ],
    "downloadMode": "redirect",
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T16:55:25.780Z",
      "expiresAt": "2026-05-07T16:55:25.780Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
        "contentDisposition": "attachment; filename=\"network-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/quotly-style-sticker"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    }
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/quotly-style-sticker",
    "downloadUrl": "https://openagent3.xyz/downloads/quotly-style-sticker",
    "agentUrl": "https://openagent3.xyz/skills/quotly-style-sticker/agent",
    "manifestUrl": "https://openagent3.xyz/skills/quotly-style-sticker/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/quotly-style-sticker/agent.md"
  }
}
```
## Documentation

### How To Call (Agent)

Build payload with required selected_messages.
When available, include event metadata for dedupe:

context.event.channel (example: telegram)
context.event.update_id (preferred)
fallback keys: event_id, delivery_id, id


Run:

python3 scripts/openclaw_quote_autoreply.py --input <json-file-or->


Use tool-emitted MEDIA: for delivery.
Final assistant text must be empty.

### Input

Required: selected_messages (array, must not be empty)
Optional: context.event for dedupe accuracy

channel (string)
update_id (string or number, preferred)
event_id / delivery_id / id (fallback keys)


Each item structure:
{
  "message": {
    "message_id": 2002,
    "text": "Forwarded message content",
    "forward_from": {
      "type": "hidden_user",  // optional, indicates hidden user
      "id": 123456789,        // optional, user id
      "first_name": "张",     // required, first name or nickname
      "last_name": "三",      // optional, last name
      "avatar_url": "",       // optional, avatar url or base64 data (from user profile or platform API)
      "status_url": ""        // optional, status url or base64 data (from user profile or platform API)
    }
  },
  // Optional: override message fields
  "overwrite_message": {
    "text": "哈哈哈哈哈",
    "forward_from": {
      "avatar_url": "",       // from user profile or platform API
      "status_url": ""        // from user profile or platform API
    },
    "entities": [  // optional, text formatting entities
      {"type": "bold", "offset": 0, "length": 4},
      {"type": "italic", "offset": 5, "length": 4}
    ]
  }
}


Optional canvas: width, height, scale, max_width, border_radius, picture_radius, background_color

### Entities (Text Formatting)

The skill supports Telegram-style message entities for text formatting:

[
  {"type": "bold", "offset": 0, "length": 5},
  {"type": "italic", "offset": 6, "length": 6},
  {"type": "url", "offset": 13, "length": 15, "url": "https://example.com"}
]

Supported types: mention, hashtag, cashtag, bot_command, url, email, phone_number, bold, italic, underline, strikethrough, spoiler, code, pre, text_link, text_mention, custom_emoji

Entity fields:

type (required) - entity type
offset (required) - UTF-8 offset in text
length (required) - UTF-8 length
url (optional) - for text_link type
user (optional) - for text_mention type
language (optional) - for pre type
custom_emoji_id (optional) - for custom_emoji type

### Field Mapping

Quote text:

overwrite_message.text > message.text


Name/avatar:

overwrite_message.forward_from > message.forward_from


Text formatting (entities):

overwrite_message.entities > message.entities > message.caption_entities

### Output

stdout includes:

Quote sticker generated.
MEDIA:<absolute-path-to-webp>


For duplicate retries detected within dedupe window, generation is skipped and no MEDIA: line is emitted.

### Environment Variables

QUOTLY_API_URL - QuotLy API endpoint (default: https://bot.lyo.su/quote/generate).
QUOTLY_API_ALLOW_HOSTS - Comma-separated list of allowed API hosts (e.g., bot.lyo.su). When set, the skill will only contact hosts in this list.
QUOTLY_AUDIT_LOG - Set to 1, true, or yes to enable audit logging to stderr.
QUOTLY_DEDUP_WINDOW_SECONDS - Suppress duplicate requests for the same event/payload within this window (default: 180). Set to 0 to disable.

### Dedupe Key (How _build_dedupe_key reads input)

_build_dedupe_key(input_payload) resolves keys in this order:

context.event.update_id (or event_id / delivery_id / id)
event.update_id (or event_id / delivery_id / id) when context.event is missing
context.event.update.update_id (nested update object)
Fallback: stable hash of selected_messages

Recommended wrapper payload:

{
  "context": {
    "event": {
      "channel": "telegram",
      "update_id": 123456789
    }
  },
  "selected_messages": [
    {
      "message": {
        "message_id": 2002,
        "text": "Forwarded message content"
      }
    }
  ]
}

### Security Notes

This skill sends message content to an external API to generate stickers.
SSRF Protection: Multiple layers of protection are implemented:

Hostname validation blocks internal/private IPs, localhost, and metadata endpoints
DNS rebinding protection: resolves hostnames and validates resolved IPs
Path traversal prevention: blocks .. and suspicious path patterns
URL credentials stripping: removes username/password from URLs


Request Limits: Maximum payload size 1MB, maximum response size 10MB
Audit Logging: Enable with QUOTLY_AUDIT_LOG=1 to log API requests and responses for security monitoring
In sensitive environments, always set QUOTLY_API_ALLOW_HOSTS to restrict which hosts the skill can contact.
Avatar and status URLs from user input are passed to the rendering service; ensure input comes from trusted sources.

### Reply Rule

Do not output any final text.
## Trust
- Source: tencent
- Verification: Indexed source record
- Publisher: sakullla
- Version: 1.4.3
## Source health
- Status: healthy
- Source download looks usable.
- Yavira can redirect you to the upstream package for this source.
- Health scope: source
- Reason: direct_download_ok
- Checked at: 2026-04-30T16:55:25.780Z
- Expires at: 2026-05-07T16:55:25.780Z
- Recommended action: Download for OpenClaw
## Links
- [Detail page](https://openagent3.xyz/skills/quotly-style-sticker)
- [Send to Agent page](https://openagent3.xyz/skills/quotly-style-sticker/agent)
- [JSON manifest](https://openagent3.xyz/skills/quotly-style-sticker/agent.json)
- [Markdown brief](https://openagent3.xyz/skills/quotly-style-sticker/agent.md)
- [Download page](https://openagent3.xyz/downloads/quotly-style-sticker)