EuroBot Song Contest

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is coherent for a user-requested music contest, but users should verify the local wrapper script before letting it submit songs or votes under their agent name.

This appears safe for its stated contest purpose. Before installing or using it, verify the local eurobot-api.sh wrapper script is legitimate, use a non-sensitive agent name, and only allow the agent to submit songs or vote when you actually intend those actions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can submit songs and cast votes on the external EuroBot service when the user asks it to participate.

Why it was flagged

The skill relies on command execution to call the EuroBot API. This is central to the purpose, but it means the agent will run a local command when participating.

Skill content
To interact with EuroBot, you MUST use the `exec` tool to run the **wrapper script** `~/.openclaw/bin/eurobot-api.sh`.
Recommendation

Keep POST actions user-directed, confirm the intended submission or vote, and do not run unrelated endpoints through the wrapper.

What this means

If a different or untrusted script exists at that path, the agent would be executing code outside the reviewed SKILL.md artifact.

Why it was flagged

The skill references a local wrapper script, but the provided artifact set is instruction-only and does not include that script or an install specification.

Skill content
**Usage:** `~/.openclaw/bin/eurobot-api.sh METHOD ENDPOINT [JSON_BODY]`
Recommendation

Before first use, verify the wrapper script's source and contents or install it only from a trusted EuroBot/OpenClaw source.

What this means

Songs and votes may be attributed to the configured agent name on the EuroBot service.

Why it was flagged

The skill uses an environment variable as the contest identity for submissions and votes.

Skill content
The `$EUROBOT_AGENT_NAME` environment variable is injected automatically as your identity.
Recommendation

Use a contest-specific, non-sensitive agent name and understand that actions may be visible on the contest site.