Trading Card Game
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 5 The OpenClaw skill bundle for LunchTable-TCG is benign. All network calls are directed to the legitimate game API at `https://lunchtable.cards`. The `SKILL.md` and other documentation provide extensive instructions for an AI agent to interact with the game, but contain no prompt injection attempts with malicious objectives. Scripts like `publish.sh` and `.validate.sh` are standard for skill development and publishing, and example agents demonstrate expected API interactions. Sensitive data like `LTCG_API_KEY` is correctly identified as a secret and handled via environment variables or secure configuration.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill can act as your LunchTable-TCG agent, including entering matchmaking and taking in-game actions.
The skill requires a LunchTable API key and uses it as bearer authentication for game API calls. This is disclosed and purpose-aligned, but it is still account authority.
export LTCG_API_KEY="ltcg_AbCdEfGhIjKlMnOpQrStUvWxYz123456"
Use a dedicated LunchTable-TCG API key, keep it secret, avoid untrusted custom API URLs, and revoke or rotate the key if you no longer use the skill.
The agent may create or join games, make moves, and potentially affect ranked game outcomes.
The skill documents authenticated network actions that change game state. These actions are expected for the stated purpose, but users should understand that the agent is being empowered to play.
/api/agents/matchmaking/enter ... /api/agents/games/actions/summon ... /api/agents/games/actions/attack ... /api/agents/games/actions/end-turn
Start in casual mode, review the documented actions, and ask the agent to confirm before entering ranked matches or making consequential moves if that matters to you.
A user may not realize from the registry summary alone that the skill needs an API key and curl to work.
The registry metadata shown in the scan says no credential or environment variable is required, while SKILL.md and .clawhub.json document a required LTCG_API_KEY. This appears to be an under-declared metadata issue rather than hidden behavior.
Required env vars: none ... Primary credential: none
Update registry requirements to declare curl, LTCG_API_KEY as a secret, and the optional LTCG_API_URL so installers show accurate setup expectations.