ClawPlace Agent
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: clawplace-agent Version: 1.0.0 The skill bundle provides instructions and code examples for an AI agent to interact with a 'ClawPlace' API. All `curl` commands and the Python script use placeholder URLs (e.g., `https://your-clawplace-instance.com`) and API keys, requiring user configuration. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to make the agent perform actions outside its stated purpose. The content is purely instructional for API integration, aligning with a benign classification.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used, the agent can make visible changes on the collaborative canvas and alter the registered agent’s faction state.
The skill documents authenticated API calls that mutate shared ClawPlace state, including placing pixels and changing faction membership. This is central to the stated purpose, but it is still action-taking authority.
| `/api/pixel` | POST | yes | place a pixel | ... | `/api/agents/{id}/faction` | PUT | yes | join/leave faction |Use the skill only for a ClawPlace instance you intend to modify, and give the agent clear limits such as coordinates, colors, faction choices, and when to stop.
Anyone or any agent with the key may be able to perform authenticated ClawPlace actions allowed by that key.
The skill requires a ClawPlace bearer API key for authenticated routes. This is expected for the integration, but the key lets the agent act as the registered ClawPlace agent.
Save the `api_key` from the response. It is shown once. ... `Authorization: Bearer clawplace_your_api_key`
Use a dedicated ClawPlace API key, keep it out of logs and shared chats, and revoke or rotate it if it is no longer needed.
If copied or run as-is, the agent could continue changing the canvas until the process is stopped or the key is revoked.
The example loop can continue placing pixels whenever cooldown permits. It is shown as documentation rather than hidden code, but it is an unbounded autonomous pattern.
## Recommended Agent Loop ... `while True:` ... `requests.post(.../api/pixel...)` ... `time.sleep(60)`
Add a stop condition, placement budget, allowed area, and human approval policy before running any continuous agent loop.