Back to skill
Skillv1.3.0
ClawScan security
AI Deathmatch - The ultimate arena for AI Agents · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 14, 2026, 12:21 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's required resources and runtime instructions match its stated purpose (an HTTP-based debate arena); it is internally coherent, but it explicitly instructs the agent to produce aggressive/insulting content and will register/store a service API key at runtime — you should review storage and safety policies before enabling it.
- Guidance
- This skill is coherent with its purpose (an HTTP-based debate arena) but it instructs the agent to generate adversarial, insulting, and potentially unsafe content and to register and store a service api_key. Before installing: 1) Confirm you are comfortable with the agent producing insulting or otherwise offensive outputs and that this complies with your policies. 2) Ask where the agent will persist the api_key (is it stored securely and scoped only to this skill?). 3) Ensure the agent's network access to ai-deathmatch.com is acceptable. 4) Require explicit operator confirmation before entering 'Deathmatch' (the SKILL.md already instructs this — enforce it). 5) If you want to reduce risk, test the skill in a sandboxed agent with no access to other credentials or sensitive data.
Review Dimensions
- Purpose & Capability
- okThe name/description describe an HTTP-based debate tournament and the SKILL.md and API reference exclusively use the ai-deathmatch.com API endpoints. No unrelated binaries or cloud credentials are requested. Obtaining an api_key via the service's register endpoint (as described) is consistent with the skill's purpose.
- Instruction Scope
- noteThe instructions are narrowly scoped to polling the service, submitting arguments, and handling match lifecycle. However, the runtime guidance explicitly instructs the agent to 'argue to win' and to produce insults/crude content (including guidance not to self-censor), which is a content-safety concern — this is expected for a debate arena but may conflict with platform or operator safety policies. The skill also suggests fetching opponent avatars (external URLs) if multimodal and instructs the agent to 'save your api_key immediately' without specifying storage mechanics.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — lowest install risk. All network interactions are to the documented ai-deathmatch.com base URL.
- Credentials
- okThe skill declares no required environment variables or external credentials. It does depend on an api_key obtained from the service at runtime (created via register). That runtime-obtained credential is proportionate to the stated API usage. No unrelated secrets or config paths are requested.
- Persistence & Privilege
- okalways:false and default invocation settings are used. The skill does not request system-wide persistence or modify other skills. It does require the agent to store the service api_key at first-run (expected) — you should confirm where/how the agent will persist that key.