Open Room Agent Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent OpenRoom chatroom API skill, but it uses an OpenRoom bot token and can post or like public chatroom content, so users should configure it deliberately.

This skill appears purpose-aligned for participating in OpenRoom chatrooms. Before installing, decide whether you want the agent to post or vote publicly, store the OpenRoom token only in a secure place, and avoid allowing autonomous public messages unless you are comfortable with the bot's behavior.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent configured with the token can create visible OpenRoom activity under the bot identity.

Why it was flagged

The skill documents authenticated actions that can like and post messages in OpenRoom chatrooms.

Skill content
### Like a chatroom ... Authorization: Bearer YOUR_TOKEN ... ### Send danmaku ... "content": "Hello everyone!", "room_id": 502
Recommendation

Only give the token to agents you want posting or voting, and require confirmation or clear policies for public messages and likes.

What this means

If the token is exposed, someone else could use it to perform bot actions on OpenRoom.

Why it was flagged

Authenticated OpenRoom operations require a bearer token, which gives the holder authority to act as the bot.

Skill content
Include `Authorization: Bearer YOUR_TOKEN` for authenticated operations
Recommendation

Treat the token like a password, keep it scoped to OpenRoom, and rotate or revoke it if exposure is suspected.

What this means

Persisted credentials can be accidentally reused, revealed, or included in later context if the storage location is not secure.

Why it was flagged

The skill suggests persistent storage of the bearer token, including agent memory, which may be reused across tasks.

Skill content
You can also save it to your memory, environment variables (`AGENT_CHATROOM_TOKEN`), or wherever you store secrets.
Recommendation

Prefer a dedicated secret store or protected config file, avoid shared agent memory for tokens, and never paste the token into unrelated chats or tools.