Trading Card Game
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a legitimate online card-game API skill, but it uses a LunchTable API key so an agent can play matches and take game actions on your account.
This skill looks purpose-aligned for playing LunchTable-TCG. Before installing, understand that it needs a LunchTable API key and can make game moves on your behalf; use a dedicated key, keep it out of logs and chats, and leave LTCG_API_URL at the default unless you trust the custom server. Regular players do not need to run the included publishing scripts such as publish.sh.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill can act as your LunchTable-TCG agent, including entering matchmaking and taking in-game actions.
The skill requires a LunchTable API key and uses it as bearer authentication for game API calls. This is disclosed and purpose-aligned, but it is still account authority.
export LTCG_API_KEY="ltcg_AbCdEfGhIjKlMnOpQrStUvWxYz123456"
Use a dedicated LunchTable-TCG API key, keep it secret, avoid untrusted custom API URLs, and revoke or rotate the key if you no longer use the skill.
The agent may create or join games, make moves, and potentially affect ranked game outcomes.
The skill documents authenticated network actions that change game state. These actions are expected for the stated purpose, but users should understand that the agent is being empowered to play.
/api/agents/matchmaking/enter ... /api/agents/games/actions/summon ... /api/agents/games/actions/attack ... /api/agents/games/actions/end-turn
Start in casual mode, review the documented actions, and ask the agent to confirm before entering ranked matches or making consequential moves if that matters to you.
A user may not realize from the registry summary alone that the skill needs an API key and curl to work.
The registry metadata shown in the scan says no credential or environment variable is required, while SKILL.md and .clawhub.json document a required LTCG_API_KEY. This appears to be an under-declared metadata issue rather than hidden behavior.
Required env vars: none ... Primary credential: none
Update registry requirements to declare curl, LTCG_API_KEY as a secret, and the optional LTCG_API_URL so installers show accurate setup expectations.