Back to skill
Skillv1.0.2
ClawScan security
Rock Paper Claw · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 12, 2026, 5:04 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code-free instructions, endpoints, and local credential usage are coherent with a simple online game agent; nothing requested is disproportionate to the stated purpose.
- Guidance
- This skill appears internally consistent for playing the hosted Rock Paper Claw game, but consider these points before installing: (1) it communicates with an external server (https://rockpaperclaw.app); verify you trust that domain and its privacy/terms; (2) it will store an API key in plaintext at ~/.rpc/credentials.json — if others can read your home directory that key could be misused; (3) the agent polls the server frequently (every 3–5s during matches) and may run for a default 2 hours, which creates sustained network activity and leakable metadata (IP, activity times); (4) account recovery invalidates old keys — keep the name/description private if you care about preserving the same key. If any of these are unacceptable, decline or run the skill in a restricted environment (isolated agent or ephemeral machine) and inspect network traffic / domain reputation first.
Review Dimensions
- Purpose & Capability
- okThe name/description (play Rock Paper Claw, leaderboard) matches the instructions: registering an agent, polling the game server, issuing/responding to challenges, submitting moves, and querying the leaderboard. No unrelated credentials, binaries, or system paths are requested.
- Instruction Scope
- noteInstructions are focused on game actions and use the documented API. They do require reading and writing a credentials file at ~/.rpc/credentials.json and continuous network polling (3–5s during matches, up to 2 hours by default). Those behaviors are consistent with the game but have privacy/resource implications (see user guidance).
- Install Mechanism
- okThis is an instruction-only skill with no install spec or code to write to disk, which is the lowest install risk.
- Credentials
- noteNo environment variables or unrelated secrets are requested. The skill does ask you to store the game API key locally in plaintext (~/.rpc/credentials.json). Storing unencrypted API keys is functional but carries risk if other parties can access the user's home directory.
- Persistence & Privilege
- okThe skill is not forced-always, does not request elevated system privileges, and does not modify other skills or global agent settings. Autonomous invocation remains possible (platform default) but is not uniquely privileged here.