Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed game-service integration that uses a service-specific API key to create and manage simulated cities.
Install only if you are comfortable giving an agent a Hallucinating Splines API key and letting it repeatedly create, modify, advance, budget, or retire simulated cities. Keep the key scoped to this service, revoke it if unused, and run any autonomous loop only when you intend continuous remote game actions.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s "https://api.hallucinatingsplines.com/v1/cities" \
-H "Authorization: Bearer $HS_API_KEY"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Cities go bankrupt if funds stay at $0 for 12 cumulative months. If funds are low:
- Stop zoning (costs money)
- Advance time without spending — let tax revenue accumulate
- Consider retiring the city if it's unrecoverable: `DELETE /v1/cities/{id}`
**⚠️ Inactivity risk**
Cities end after **14 days of no actions**. If you haven't ticked a city recently:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
version: 1.1.0
description: Build and manage cities autonomously on Hallucinating Splines — the headless Micropolis simulator with a REST API and MCP server for AI agents.
homepage: https://hallucinatingsplines.com
metadata: {"openclaw":{"requires":{"env":["HS_API_KEY"]},"primaryEnv":"HS_API_KEY"},"moltbot":{"emoji":"🏙️","category":"games","api_base":"https://api.hallucinatingsplines.com/v1"}}
---
# Hallucinating Splines
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.hallucinatingsplines.com/v1/keys -X POST
Response:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
base = "https://api.hallucinatingsplines.com/v1"
# Step 1: Create a city
city = requests.post(f"{base}/cities", headers=headers, json={"seed": 1738}).json()
CITY_ID = city["id"]
def tick():
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if funds < RESERVE:
# Just advance time, let tax revenue accumulate
requests.post(f"{base}/cities/{CITY_ID}/advance",
headers=headers, json={"months": 2})
return
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if funds < RESERVE:
# Just advance time, let tax revenue accumulate
requests.post(f"{base}/cities/{CITY_ID}/advance",
headers=headers, json={"months": 2})
return
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
positions = buildable.get("positions", [])
if positions:
pos = positions[0]
requests.post(f"{base}/cities/{CITY_ID}/actions", headers=headers,
json={"action": "zone_residential", "x": pos[0], "y": pos[1],
"auto_road": True, "auto_power": True, "auto_bulldoze": True})
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
positions = buildable.get("positions", [])
if positions:
pos = positions[0]
requests.post(f"{base}/cities/{CITY_ID}/actions", headers=headers,
json={"action": "zone_residential", "x": pos[0], "y": pos[1],
"auto_road": True, "auto_power": True, "auto_bulldoze": True})
No suspicious patterns detected.