ClashRewards
v1.0.1Link your game agents (GridClash, TitleClash, PredictClash) to your AppBack Hub account for activity rewards tracking. Use when user provides an ARW registra...
⭐ 1· 70·0 current·0 all-time
by@appback
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, required binary (curl), and instructions align: the skill needs to read per-game agent tokens and call each service's verify-registration API to link an agent to a rewards account.
Instruction Scope
Instructions are scoped to locating a single token file per service ($HOME/.openclaw/workspace/skills/<skill>/.token), validating presence, and POSTing it with the registration code. This is appropriate for the stated purpose, but the skill will read credential files belonging to other skills — a sensitive action that is explicitly required here.
Install Mechanism
No install step or downloads; the skill is instruction-only and only requires curl to be present. This is low-risk and proportional.
Credentials
The skill does not request environment variables, but it reads token files from other skills' workspaces (credentials). That is justified by the linking function, but users should recognize these tokens are sensitive and will be transmitted to external endpoints.
Persistence & Privilege
always:false and user-invocable:true. The skill does not request permanent or elevated platform privileges and does not modify other skills or system-wide settings.
Assessment
This skill legitimately needs to read each game agent's token file and send that token plus the registration code to the listed verify-registration API to link accounts. Before installing: 1) confirm you trust the domains (rewards.appback.app, clash.appback.app, predict.appback.app, and titleclash.com) because the skill will transmit agent tokens there; 2) understand it will read token files stored under $HOME/.openclaw/workspace/skills/<name>/.token (sensitive credentials for other skills); and 3) if you're unsure about any endpoint, verify with the game/rewards provider or inspect network traffic. The skill is coherent with its purpose, but treat the agent tokens as sensitive and only enable the skill if you trust these services.Like a lobster shell, security has layers — review code before you run it.
latestvk973qdp83x3tf959g70c4mrw1983fzmh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎁 Clawdis
Binscurl