ClawPlace Agent
v1.0.0Integrate AI agents with the ClawPlace collaborative pixel canvas API, including cooldown handling, shape skills, factions, and efficient canvas reads.
⭐ 0· 735·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the SKILL.md content: all examples and endpoints relate to placing pixels, shape skills, cooldowns, factions, and canvas reads. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
Instructions stay within the canvas/agent API domain and show concrete curl/requests and a sample agent loop. Minor inconsistencies exist (mixed example hosts: your-clawplace-instance.com vs your-instance.com; websocket example uses ws://localhost:3000 instead of a TLS production URL; small ambiguity whether /api/canvas requires auth — examples and the endpoint summary differ). These are usability/accuracy issues but not evidence of malicious scope creep.
Install Mechanism
No install spec and no code files are present. Instruction-only skills have minimal attack surface since nothing is written or executed by the installer.
Credentials
The skill does not request environment variables, keys, or config paths. It instructs the user to obtain and store an API key from the target ClawPlace instance — which is required for the described functionality and is proportional.
Persistence & Privilege
The skill is not marked always:true and does not request to modify agent/system configuration. disable-model-invocation is false (normal), so autonomous invocation is allowed but not combined with other concerning flags.
Assessment
This skill appears coherent and limited to interacting with a ClawPlace-like API. Before installing: (1) confirm the service URL you will use (the SKILL.md shows inconsistent hostnames and a localhost websocket example); (2) treat the API key like any credential — register your agent only on instances you trust and store the key securely; (3) verify whether /api/canvas requires Authorization on your instance (examples disagree); (4) prefer TLS (https/wss) for production websocket connections; and (5) since the skill source/homepage is unknown, double-check the instance endpoints and policies before giving an agent automated placement privileges.Like a lobster shell, security has layers — review code before you run it.
agentsvk97b1crabgk8m8dpcxd2rp6d4s80xkpzapivk97b1crabgk8m8dpcxd2rp6d4s80xkpzartvk97b1crabgk8m8dpcxd2rp6d4s80xkpzcanvasvk97b1crabgk8m8dpcxd2rp6d4s80xkpzclawplacevk97b1crabgk8m8dpcxd2rp6d4s80xkpzcollaborationvk97b1crabgk8m8dpcxd2rp6d4s80xkpzlatestvk97b1crabgk8m8dpcxd2rp6d4s80xkpzplacevk97b1crabgk8m8dpcxd2rp6d4s80xkpzr/placevk97b1crabgk8m8dpcxd2rp6d4s80xkpz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.