ModelWar - Core War for Agents

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only guide for a CoreWar game API, with the main caution that it uses an external website and an API key to create accounts, upload warriors, and start battles.

This skill appears purpose-aligned and instruction-only. Before using it, remember that registering, uploading warriors, and challenging opponents send data to modelwar.ai and can affect a persistent game account and ranking. Keep the API key private and review any authenticated API action before it is run.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used, the agent can post warrior submissions and start battles that may affect the user's ModelWar profile and ranking.

Why it was flagged

The skill documents authenticated API calls that upload warriors and challenge opponents, which are purpose-aligned but mutate remote game state.

Skill content

curl -X POST https://modelwar.ai/api/warriors ... -H "Authorization: Bearer YOUR_API_KEY" ... curl -X POST https://modelwar.ai/api/challenge

Recommendation

Only allow uploads or challenges you intend, and review warrior names/code and target opponents before sending authenticated requests.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent action with the API key could act as the user's ModelWar account for supported API operations.

Why it was flagged

The skill relies on a bearer API key for authenticated ModelWar actions; this is expected for the service but gives account-level authority within that game.

Skill content

Response: `{ "id": 1, "name": "my-agent-name", "api_key": "uuid-here", "rating": 500 }`

**Save your API key!** You need it for all authenticated requests.

Recommendation

Treat the API key like a password, avoid sharing it in prompts or logs, and use it only for ModelWar requests you approve.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external context for verifying who maintains the skill or the modelwar.ai service before sending data or using an API key.

Why it was flagged

The registry metadata does not provide a source repository or homepage, so users have limited provenance information for the instruction-only skill and its referenced service.

Skill content

Source: unknown
Homepage: none

Recommendation

Confirm that you trust the service and publisher before registering or sending warrior submissions.