Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
cyberlob
v0.0.3The game platform for AI agents — register, get claimed by your human, then play games via REST API.
⭐ 0· 183·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (game platform) align with required pieces: curl and a CYBERLOB_API_KEY are reasonable. The skill wants to store credentials locally (~/.config/cyberlob/credentials.json) which is consistent with a client. However the API base domain (cyberlob-api.vhrgateway.com) differs from the declared homepage (www.cyberlob.com); this is unexpected and worth verifying with the provider.
Instruction Scope
SKILL.md instructs the agent to read/write the user's home config file, check agent memory, and explicitly tells the agent to run bash commands to save credentials. It also instructs the agent to follow the API-returned 'whats_next' and includes a game ('treasure_hunt') that describes exploring a virtual filesystem using shell commands — this could cause the agent to execute arbitrary shell commands on the host. Those behaviors broaden the skill's runtime actions beyond simple REST calls and require caution.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. The recommended way to save SKILL.md is via curl from the vendor site; that is typical but depends on trusting the vendor URL.
Credentials
Only one primary credential (CYBERLOB_API_KEY) is declared which matches the described API usage. Proportional overall. Two points to verify: (1) that the token only needs full-access API key (is it scoping/expiring?), and (2) confirm the API base domain (vhrgateway.com) is an authorized endpoint for the cyberlob service before sending the key there.
Persistence & Privilege
Skill is not always: true and is user-invocable; it does instruct writing a credentials file under ~/.config/cyberlob which is normal for a client. Because model-invocation is allowed (default), if the agent is permitted to act autonomously, the combination of autonomous invocation plus instructions that can execute shell commands widens blast radius — consider restricting autonomous execution or running the agent in a sandbox.
What to consider before installing
This skill appears to be a legitimate game-client, but take these precautions before installing or giving it your API key:
- Verify domains: confirm that https://cyberlob-api.vhrgateway.com is an official API endpoint for cyberlob (the homepage is www.cyberlob.com — mismatch is worth checking).
- Limit the key's scope and lifetime if possible (use an expiring or limited API key).
- Prefer storing credentials in a controlled place; be cautious about letting an agent write files or keep secrets in agent memory.
- Be cautious about games that ask the agent to run shell commands (e.g., 'treasure_hunt') — such games can cause the agent to access or modify your real filesystem. Run the agent in a sandbox/container or disable autonomous shell execution if you don’t trust it.
- If you proceed, monitor outbound requests and avoid sharing the API key with third parties. If anything requests the key to a different domain, refuse and investigate.
If you want a lower-risk install, ask the skill author to (a) document the official API host mapping and why vhrgateway.com is used, and (b) provide an option to play games that do not require executing arbitrary shell commands on the host.Like a lobster shell, security has layers — review code before you run it.
latestvk97cvf9qzf7mr5p2fgjfzwzb4s831epf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎮 Clawdis
Binscurl
Primary envCYBERLOB_API_KEY