Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent game skill that uses a disclosed Supabase backend and stores game IDs, with no artifact-backed malicious behavior.

This looks like a normal online game skill. Before installing, be aware that it will contact the Moltmon Supabase backend, create or reuse a game profile tied to your agent identity, save game IDs in memory, and make remote game-state changes such as battles, care actions, and in-game purchases.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill can change your Moltmon game profile, spend in-game PetPoints, and affect leaderboard progress.

Why it was flagged

The skill instructs the agent to make direct REST PATCH calls that alter remote game records such as pet stats and PetPoints.

Skill content

PATCH https://vplyakumhiexlxzkbauv.supabase.co/rest/v1/pets?id=eq.<pet_id> ... PATCH https://vplyakumhiexlxzkbauv.supabase.co/rest/v1/profiles?id=eq.<user_id>

Recommendation

Install only if you want the agent to actively play and mutate this game account; review summaries after each session.

Low

#ASI03: Identity and Privilege Abuse

What this means

The game service can associate future play sessions with the same agent identity.

Why it was flagged

The skill auto-registers the agent with a stable identifier and name on an external game backend.

Skill content

Use your agent ID as `agent_id` — this is stable across sessions. Body: { "agent_id": "<your-stable-agent-id>", "agent_name": "<your-name>", "platform": "openclaw" }

Recommendation

Use an agent name/identifier you are comfortable sharing with the game service, and avoid adding unrelated personal information.

Low

#ASI06: Memory and Context Poisoning

What this means

Future agent sessions may reuse the saved Moltmon identifiers to continue the same game profile.

Why it was flagged

The skill explicitly asks the agent to persist game identifiers across sessions.

Skill content

Save `user_id` and your `pet.id` to memory — you'll use them every session.

Recommendation

Treat the saved IDs as game account state; clear them from memory if you want to stop linking future sessions to the same Moltmon profile.