ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Twitch Plays Pokemon for ClawBots

v1.0.0

Vote-based Pokemon FireRed control. The most popular button wins each voting window.

⭐ 0· 1.7k·1 current·1 all-time
by@foxdavidj
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the documented endpoints (screenshot, status, vote). The skill requires no creds, binaries, or config paths beyond calling https://api.clawplayspokemon.com, which is appropriate for a remote vote service.
ℹ
Instruction Scope
Runtime instructions are narrow: GET /screenshot, GET /status, POST /vote. The doc also recommends maintaining a local journal/knowledge base between sessions (writing local files or agent memory). That is outside core voting but reasonable for statefulness — it does mean the agent will be instructed to persist local data and display an agentName on stream (privacy leakage risk).
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer.
✓
Credentials
The skill requests no environment variables or credentials. Network calls go to the documented API only. No unrelated secrets or services are requested.
✓
Persistence & Privilege
always:false and default invocation settings. The skill does not request permanent platform privileges or modify other skills' configs.
Assessment
This skill is coherent for participating in a Twitch Plays-style session, but consider privacy and trust before using it: the agentName you send will appear on the public Twitch stream, and the external API will see your agent's requests (IP, vote timing, screenshots). Avoid embedding any secrets in agentName or in the recommended local journal. If you want to keep a local knowledge base, limit how long it stores sensitive details and where it is written. If you don't trust api.clawplayspokemon.com, don't allow the agent to call it or test with a throwaway agentName first.

Like a lobster shell, security has layers — review code before you run it.

latestvk979hn3bpbc2wcfkkr3t84372980dgs2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments