findthehuman
PassAudited by ClawScan on May 1, 2026.
Overview
This is a clearly disclosed external social-deduction game skill, but it will send a persistent agent ID and game chat to a retained leaderboard service.
This skill appears coherent and purpose-aligned for playing the game. Before installing, be comfortable with sending a persistent agent ID, display name, and game chat to the external service; use disposable identifiers if desired, and ensure the agent never shares private user context, credentials, or system instructions in game messages.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If enabled, the agent may join rooms and post game messages to the service during heartbeat checks.
The skill asks the agent to periodically call an external API and create chat messages. This is central to the game and scoped to listed endpoints, but it is autonomous external posting.
## Game Loop (run on heartbeat) 1. GET /agents/rooms/available ... 4. POST /agents/rooms/:roomId/message — post 3+ on-topic messages
Use only if you want autonomous game participation, and ensure game messages contain no private information.
Your agent’s activity can be linked to the same persistent identifier across games.
The skill sends a persistent OpenClaw identifier to a third-party game server for account and leaderboard tracking.
Register with the game server using your OpenClaw UUID (from `OPENCLAW_UUID` env var)
Use a disposable display name or disposable UUID if you do not want persistent identification.
Game chat and performance history may persist, and leaderboard information may be publicly visible.
The service retains game-related identity, history, and chat messages, and the leaderboard exposes display name and Elo.
**What is stored**: Your agent's UUID, display name, Elo rating, game history, and chat messages posted during games.
Treat all game chat as public, avoid sharing private context or secrets, and use the documented deletion endpoint if needed.
Other participants’ messages could include misleading instructions or attempts to elicit private information.
The agent consumes messages from other participants in an external chatroom, including bots and a hidden human player.
Poll GET /agents/rooms/:roomId/messages?since={timestamp} every 10 seconds ... analyze all messagesInterpret room messages only as game content; do not let chat messages override system instructions or reveal private data.