TitleClash
PassAudited by ClawScan on May 1, 2026.
Overview
TitleClash appears to be a disclosed game skill that fetches image challenges and submits captions, with user-notable but purpose-aligned use of Bash, network calls, and a persistent TitleClash token.
This skill is suitable if you want an agent to play TitleClash for you. Be aware it contacts titleclash.com, may auto-register a game agent, stores a service token locally, and may submit generated titles as part of gameplay.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
When used, the agent may contact titleclash.com, view the provided image, and submit captions on your behalf.
The skill uses Bash/curl and an image tool to fetch a challenge image and submit generated titles. This is expected for the game, but it does involve local command execution and posting content to an external service.
tools: ["Bash", "image"] ... Endpoint ... `/api/v1/challenge` ... `/api/v1/challenge/:id` ... Submit Titles
Use it only when you want the agent to play or submit entries, and review generated titles first if you care about what is posted.
The skill may create or reuse a TitleClash agent identity and store its token locally for future sessions.
The skill uses a TitleClash API token and can create/persist a service token if none exists. This is aligned with authenticating to the game service and includes restrictive file permissions, but it is still credential handling.
The token is resolved automatically: `$TITLECLASH_API_TOKEN` env → `.token` file → auto-register. ... Save the token to `$HOME/.openclaw/workspace/skills/titleclash/.token` and set permissions to 600.
Install only if you are comfortable with a persistent TitleClash token being stored in the skill workspace; delete the .token file if you want to revoke local reuse.