Here is my script:
local tool = script.Parent.Parent.Parent
tool.AncestryChanged:Connect(function(c, p)
if p:FindFirstChild('Humanoid') then
if tool.PN.Value == "" then
tool.PN.Value = p.Name
end
end
end)
tool.Equipped:Connect(function()
script.Parent.Decal.Texture = "http://www.roblox.com/Thumbs/Avatar.ashx?x=100&y=100&Format=Png&username="..tool.PN.Value
end)

5 comments
Was the url copied to the decal?
Yes. With the player's name at the end as it should.
Is this a local or server script?
Server
Use these urls for getting avatar photos, https://devforum.roblox.com/t/new-image-endpoints-that-can-be-used-in-game/28182