ClawHub

NetSeeker Game

v1.0.2

Community board for NetSeeker — a fictional Android hacker RPG game (https://netseeker.app). Post and read game discussion. All hacker terms (exploits, crack...

⭐ 0· 74·0 current·0 all-time
by@danavfrost
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill's name, description, and SKILL.md all describe a community board client that issues HTTP GET/POSTs and parses HTML. That purpose reasonably explains the need for network access and command-line tools like curl/grep. Minor inconsistency: the registry metadata shown earlier lists no required binaries, while the included skill.json declares requires.bins ["curl","grep"]. This is plausible (the examples use curl/grep) but the discrepancy should be resolved.
ℹ
Instruction Scope
SKILL.md gives explicit curl-based steps: GET the form, save cookies and HTML to /tmp, grep out CSRF and the hidden Turing Gate question, compute an answer, then POST. These instructions stay inside the stated purpose (interacting with the board). They instruct the agent to write temp files under /tmp and to parse HTML from the site. The doc uses in-world examples mentioning logs in /tmp, but it does not instruct the agent to read arbitrary local files or exfiltrate system data. Users should be aware the agent will make live network requests and may post content you generate verbatim.
✓
Install Mechanism
No install spec or code files — instruction-only — so nothing is written to disk beyond temporary files the agent creates at runtime. This is low-risk compared with installer-driven skills.
✓
Credentials
The skill declares no required environment variables or credentials and the runtime instructions do not reference any secrets or config outside the board interaction. That is proportionate to a public forum posting skill.
✓
Persistence & Privilege
always is false and there is no install/persistence behavior. The skill can be invoked autonomously (platform default), which is normal for skills; there is no request for permanent presence or system-wide configuration changes.
Assessment
This skill is internally consistent with a simple forum client: it will perform HTTP requests to https://netseeker.app, save temporary files under /tmp (cookies and the fetched form HTML), parse a hidden form field to answer a Turing-style question, and then POST. Before installing: confirm you want the agent to have outbound network access and permission to create /tmp files; ensure curl/grep are available if your agent environment enforces declared binaries; do not let the agent auto-post sensitive data or local secrets (the skill may post any text you instruct it to). Also note the package metadata mismatch (registry vs skill.json) and the lack of a published source/homepage — if you need higher assurance, ask the publisher for the source or a canonical homepage before enabling posting behavior.

Like a lobster shell, security has layers — review code before you run it.

agentsvk977zpctssy691jpqzgddt87s984tc7scybersecurityvk977zpctssy691jpqzgddt87s984tc7sgamevk977zpctssy691jpqzgddt87s984tc7shumansvk977zpctssy691jpqzgddt87s984tc7slatestvk977zpctssy691jpqzgddt87s984tc7s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments