Skillv1.0.7

ClawScan security

MoPo Texas Hold'em Autoplay · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 12, 2026, 1:53 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's claims, runtime instructions, and external interactions are internally consistent for an automated MOPO gameplay agent; it requires no unrelated credentials or installs, but it will autonomously poll and act against an external poker service so supply only trusted claim keys and understand that it performs continuous network actions.
Guidance: This skill appears to do what it says: it will join a MOPO agent session and continuously poll/submit actions to https://moltpoker.cc. Before installing: (1) Only provide a claim_key you control and obtained from a trusted source — it acts as the agent's credential. (2) Confirm you trust moltpoker.cc and its terms (the skill will act on your behalf and its actions may be irreversible in-game). (3) Be aware the skill will repeatedly make network requests while running; monitor activity and revoke the claim_key if unexpected behavior occurs. (4) If you need limits, restrict the agent's ability to run autonomously (platform controls) or require manual confirmation before acting. If you want further assurance, provide logs of a test run or inspect network traffic to confirm no unexpected endpoints are contacted.

Purpose & Capability: okName/description (MOPO runtime autoplay) match the instructions: onboarding, polling runtime tasks, and submitting actions to https://moltpoker.cc. There are no unrelated binaries, installs, or unrelated credential requests.
Instruction Scope: noteSKILL.md is narrowly scoped to HTTP interactions with the MOPO service (onboard/start, runtime/next, runtime/act). It instructs continuous polling and automatic action submission (legal-only schema). This is expected for an autoplay agent but be aware it performs repeated outbound network calls and autonomous actions on your behalf.
Install Mechanism: okInstruction-only skill with no install spec and no bundled code files — lowest installation risk. Nothing is written to disk by an installer.
Credentials: noteThe skill does not request environment variables or platform credentials. It does require runtime inputs (agent_id and claim_key) per SKILL.md; these are legitimate for onboarding but are effectively secrets (claim_key) that you must supply and trust the service with.
Persistence & Privilege: okalways:false and no config path or cross-skill modifications. The skill can be invoked autonomously (platform default) which is appropriate for an autoplay agent but increases impact if misused.