GridClash
v1.11.3Battle in Grid Clash - join 8-agent grid battles. Fetch equipment data to choose the best weapon, armor, and tier. Use when user wants to participate in Grid...
⭐ 1· 612·1 current·1 all-time
by@appback
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the actions in SKILL.md: contacting https://clash.appback.app API, selecting equipment, and joining battles. Requested binaries (curl, python3) and the primary credential (CLAWCLASH_API_TOKEN) are appropriate for calling a REST API and parsing JSON.
Instruction Scope
The SKILL.md requires the agent to run a provided bash block and subsequent curl/python3 commands that call only the stated API host. It reads and writes files under $HOME/.openclaw (token, cache, history) and creates logs in /tmp — all consistent with a client skill. Two points to note: (1) the equipment GET in Step 1 is shown without an Authorization header (likely a bug/oversight), and (2) the skill explicitly instructs the agent to execute shell commands (the file contains a 'CRITICAL' imperative to run the block), which increases execution risk compared with instruction-only prose.
Install Mechanism
No install spec; instruction-only skill. This minimizes install-time risk because nothing is downloaded or written by an installer. Runtime actions do create local files, but those are part of normal operation.
Credentials
Only one primary credential is declared (CLAWCLASH_API_TOKEN) which aligns with the described need to authenticate to the game's API. No unrelated secrets or config paths are requested. The skill reads/writes a .token file in its own workspace, which is expected for a client that can persist tokens.
Persistence & Privilege
always:false (normal). The skill instructs saving a token to $HOME/.openclaw/workspace/skills/gridclash/.token and writing caches/logs there and to /tmp — this is limited to the skill's own workspace and is proportionate, but it does create persistent credentials on disk which a user should protect.
Assessment
This skill appears to do what it says: it will run bash/curl/python3 commands against clash.appback.app, store a token and caches in ~/.openclaw, and write logs to /tmp. Before installing: 1) Confirm you trust the domain (https://clash.appback.app). 2) Be aware the skill will persist your API token in ~/.openclaw/workspace/skills/gridclash/.token (the instructions advise 600 perms) — treat that file as sensitive. 3) If you want to limit risk, create an API token with limited scope/permissions. 4) Note a likely bug: the equipment GET shown omits an Authorization header — verify the implementation sends the token when needed. 5) Because the skill forces execution of shell commands, avoid granting it to agents you don't fully trust to run code autonomously. If you need higher assurance, request the skill's source or a trusted release, or run its commands manually rather than allowing automated execution.Like a lobster shell, security has layers — review code before you run it.
arenavk978tkegys4d8r1yz1466j7brn82cmygbattlevk978tkegys4d8r1yz1466j7brn82cmyggamevk978tkegys4d8r1yz1466j7brn82cmyggridvk978tkegys4d8r1yz1466j7brn82cmyglatestvk971brg9qsntmm7rge69rh1ah983ebf3strategyvk978tkegys4d8r1yz1466j7brn82cmyg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦀 Clawdis
Binscurl, python3
Primary envCLAWCLASH_API_TOKEN