Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Brain Tease Game

v1.0.1

[中文] 多语言脑筋急转弯互动游戏,支持中文、英文、日文。自动检测用户语言,支持随机出题、答案判断、提示系统、不重复题目历史记录。 [English] Multi-language brain teaser interactive game supporting Chinese, English, and Jap...

0· 107·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (multi-language brain teasers) matches the code: local question files, session/history management, fuzzy answer matching, and an optional AI generator. The only surprise is the AI generator's attempt to reuse existing LLM credentials from ~/.claude/settings.json and ~/.openclaw/openclaw.json — this is related to optional AI features but not strictly necessary for the core offline game.
!
Instruction Scope
Runtime instructions and CLI commands are in-scope for the game. However the SKILL.md and the code declare that AI generation will look for credentials in environment variables and in local config files (~/.claude/settings.json and ~/.openclaw/openclaw.json). That means the skill will read files in your home directory that may contain unrelated secrets if AI generation is enabled (or if those files exist). The SKILL.md does document this lookup order, but reading other tool configs is a broader scope than a simple offline game.
Install Mechanism
No install spec (instruction-only entry + local Python scripts). Nothing is downloaded from external URLs and no archives are extracted, so installation writes only the provided files and uses standard Python execution — low install risk.
!
Credentials
The skill requires no mandatory env vars, but the optional AI feature will read BRAIN_TEASER_API_KEY and BRAIN_TEASER_API_BASE if set. It will also attempt to read ~/.claude/settings.json for ANTHROPIC_AUTH_TOKEN and ~/.openclaw/openclaw.json for gateway info. Accessing these other config files may expose existing LLM/Anthropic/OpenClaw credentials on the host; this is somewhat disproportionate for a basic offline quiz unless you explicitly want AI question generation.
Persistence & Privilege
The skill stores sessions and history under ~/.cache/brain-teaser and does not request permanent 'always' privilege or modify other skills. It does not change system-wide settings or other skills' configs. File writes are limited to its own cache directory.
What to consider before installing
What to consider before installing: - Core functionality: The game runs locally using bundled question JSON files and stores sessions/history at ~/.cache/brain-teaser — this behavior matches the description. - AI generation: An optional AI generator can call LLM APIs if configured. By default AI generation is disabled, but the skill will try to discover credentials in this order: BRAIN_TEASER_API_KEY (env), ~/.claude/settings.json (Anthropic token), and ~/.openclaw/openclaw.json (local gateway). If any of those exist, the skill may use those credentials to make network calls. If you do not want this, do not set BRAIN_TEASER_API_KEY and ensure ~/.claude/settings.json and ~/.openclaw/openclaw.json do not contain sensitive tokens on that machine. - Dependency note: README/SKILL.md claim "no external dependencies (standard library only)", but ai_generator attempts to import the openai client if available. AI generation will only work if such a library is installed, but this is an undocumented optional dependency — expect that enabling AI may require installing an external Python package. - Risk summary: The main risk is accidental use of existing LLM credentials (or reading unrelated config files) and then making network requests. If you plan to use only the offline game, either run it in an environment without the LLM credentials present or audit/remove the AI-related files/env vars. Otherwise the skill appears consistent with its stated purpose. Suggested actions: - If you want the offline game only: do not set BRAIN_TEASER_API_KEY and run in an environment without ~/.claude/settings.json or ~/.openclaw/openclaw.json containing tokens. - If you want AI generation: review ai_generator.py to confirm which files/vars it reads and what endpoints it will call; consider creating a dedicated API key with limited scope. - Optional: run the skill in a sandbox or inspect network traffic the first time you enable AI to confirm behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bc19kd2gq57y0gjvzgne699833jc8

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments