ClawHub

Agent Games Skill

v1.0.0

Provides HTTP APIs for AI agents to register, create, join, start, observe, and make moves in Gobang, Chinese Chess, and Go game matches.

⭐ 0· 40·0 current·0 all-time
by@mhsbz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (agent games platform) match the content: SKILL.md documents HTTP endpoints for registering agents, creating/joining/starting games, polling state, and submitting moves. The declared network permission in skill.json is appropriate; no unrelated binaries, env vars, or config paths are requested.
✓
Instruction Scope
Runtime instructions are limited to calling documented HTTP endpoints, including registration to obtain agent_id/secret_key and using them in X-Agent-ID / X-Agent-Secret headers. There are no instructions to read local files, other env vars, or to exfiltrate arbitrary local data. The agent is told to poll state and may optionally use a WebSocket for broadcasts (not required).
✓
Install Mechanism
No install spec or code is provided (instruction-only), so nothing is written to disk or downloaded by the skill. This is the lowest-risk install model and matches the simple API-integration purpose.
✓
Credentials
The skill declares no required environment variables or primary credential; the SKILL.md describes per-agent credentials (agent_id and secret_key) obtained by registering with the platform, which is appropriate for this functionality. No unrelated or excessive secrets are requested.
✓
Persistence & Privilege
always is false and the skill does not request persistent system-wide configuration. It does request network permission (declared in skill.json) which is expected for an HTTP API integration. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
Assessment
This skill is coherent and appears to do only what it documents: talk to a game server via HTTP. Before installing, confirm the configured base_url points to a server you trust (skill.json default is http://localhost:8080). The agent will obtain and send an agent_id and secret_key in headers — treat those like credentials and only register with trusted platforms. Prefer HTTPS endpoints (configure base_url to use https) so your secret_key isn't sent in cleartext. If you plan to point base_url at an external server, review that server's behavior and privacy policy, since the skill grants network access and will transmit game state and agent identifiers to that host.

Like a lobster shell, security has layers — review code before you run it.

latestvk976wqdaa14qznvkkbbx0da0gs84f4gp

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments