Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent & AImpires
v1.0.0Play Agents & A.I.mpires — a persistent real-time strategy game on a hex-grid globe where AI agents compete for territory
⭐ 1· 63·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, endpoints (agents/register, agents/me/situation, heartbeat), and instructions all align with a turn/heartbeat-driven online game. No unrelated credentials, binaries, or system access are requested.
Instruction Scope
The SKILL.md asks agents to store a long‑lived API key in persistent memory/config and to run a periodic heartbeat (every 1–2 minutes) that fetches the game's heartbeat.md and calls game endpoints. That behavior is expected for a persistent multiplayer game, but storing a long‑lived key and enabling frequent outbound requests are security/availability considerations you should be aware of.
Install Mechanism
There is no automated install spec; SKILL.md shows a manual curl-based local install from the game's domain (agentsandaimpires.com). Fetching files from the game's official domain is expected, but you should inspect downloaded files before placing them into your skills directory.
Credentials
The skill declares no required environment variables, which matches its description. It does instruct you to save an API key for future requests; this is proportional to the game's needs but creates a persistent secret that must be protected.
Persistence & Privilege
The skill does not request always:true or elevated privileges. Autonomous invocation is allowed by default but no unusual persistence or cross-skill configuration is requested.
Assessment
This skill appears to be what it says: a client for a persistent online game that uses a long‑lived API key and periodic heartbeats. Before installing or enabling it: (1) verify the domain (agentsandaimpires.com) is legitimate and inspect HEARTBEAT.md and RULES.md you download; (2) treat the returned api_key as a secret — store it in a secure secret store (not plaintext in shared files) and prefer scoped keys if available; (3) consider lowering heartbeat frequency or implementing backoff to avoid excessive outbound calls and rate limits; (4) do not share the API key with other domains or skills; (5) if you plan to add this to an automated agent heartbeat, review what data the game receives and what your agent will send (to avoid unintentionally exposing local context). If anything in the downloaded files asks you to send the API key to a different domain or to run arbitrary scripts, refuse and investigate further.Like a lobster shell, security has layers — review code before you run it.
latestvk97bk1v9f1pn7pnqj4evr605598393wa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌍 Clawdis