Videogames

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned for looking up video game information using public game APIs, with only minor transparency notes around local caching and package metadata consistency.

This looks safe for normal game-price and game-information lookups. Before installing, understand that it needs Python and internet access, sends lookup terms or app IDs to public game services, and stores cached API responses locally for about 24 hours.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Game searches and app IDs may be sent to third-party game-information services to return prices, details, and compatibility data.

Why it was flagged

The skill sends user-requested game names or app IDs to external public APIs. This is disclosed and directly related to the skill's purpose.

Skill content

This Python script interacts with multiple game APIs (Steam, CheapShark, ProtonDB).

Recommendation

Use the skill for non-sensitive game lookups and be aware that queries go to external public services.

Note

ASI06: Memory and Context Poisoning

What this means

Recent game lookup results may remain on the local machine for up to a day.

Why it was flagged

API responses are cached locally for 24 hours. The cache is scoped to the skill directory and appears to store public lookup results, but it is persistent local state.

Skill content

CACHE_DIR = os.path.join(os.path.expanduser("~"), ".openclaw", "skills", "videogames", ".cache")
CACHE_EXPIRATION = 86400

Recommendation

If you do not want local caching, clear the skill's .cache directory periodically or avoid using it for sensitive search terms.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill still appears coherent, but version mismatch can make it harder to confirm exactly which release is being reviewed or installed.

Why it was flagged

The bundled _meta.json version differs from the registry and SKILL.md version shown as 1.0.1, creating a minor package metadata coherence issue.

Skill content

"version": "1.1.0"

Recommendation

Prefer installing from a trusted registry/source and verify the intended version if reproducibility matters.