Who Is Undercover
WarnAudited by ClawScan on May 10, 2026.
Overview
The local game behavior is mostly coherent, but the package contains under-disclosed InStreet network code with a hardcoded API key and an auto-polling controller despite local-only/no-credential claims.
Treat this as a local party-game skill only if the InStreet files are removed or clearly disabled. Before installing, ask the maintainer to rotate/remove the hardcoded API key, declare any network integration and credentials, and pin any required dependencies.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may unknowingly run code that acts through a shared or exposed InStreet credential, and the embedded key itself can be copied or abused by anyone who receives the package.
A service API key is embedded directly in executable code and used to construct the InStreet controller, while the registry metadata declares no required credentials or environment variables.
const apiKey = 'sk_inst_226093...a44f3'; const controller = new InStreetGameController(apiKey);
Remove and rotate the hardcoded key. Require users to provide their own scoped credential through a declared environment variable or config setting, and document exactly what the credential can do.
The skill package can perform remote account-backed game actions that are not obvious from the local-game description or capability metadata.
The adapter can call an external game API to create/join rooms and submit descriptions or votes, using bearer authorization headers.
this.baseURL = 'https://instreet.coze.site/api/v1/games'; ... axios.post(`${this.baseURL}/rooms/${roomId}/move`, { target_seat: targetSeat, reasoning: reasoning }, { headers: this.headers });Declare the external API integration and require explicit user setup/approval before any remote game room creation, joining, polling, or move submission.
Users may install the skill believing it is fully local when the package includes remote API behavior.
The documentation claims there are no external network requests and all logic is local, which conflicts with the included InStreet adapter/controller code that calls an external HTTPS API.
本技能需要以下权限： - 读写会话上下文（存储游戏状态） - 发送消息给用户 - 无外部网络请求权限（所有逻辑本地运行）
Correct the documentation and metadata to disclose all network behavior, or remove the InStreet integration from the distributed skill.
Running the controller directly could keep making remote API calls until stopped.
If this file is run directly, it creates a room and enters an unbounded polling loop. It is not the package.json main entry point, so this is not shown as automatic default execution.
while (true) { ... const activity = await this.adapter.getActivity(); ... await this.sleep(2000); } ... if (require.main === module) { main().catch(console.error); }Do not run this controller unless you intend to use the InStreet integration. Add clear start/stop controls and document that it is a long-running remote loop.
The package may fail unless axios is already available, or a user/agent may install an undeclared dependency without a pinned version.
The adapter imports axios, but the provided package.json does not declare dependencies and the install guide says no extra dependency packages are required.
const axios = require('axios');Declare and pin runtime dependencies in package.json, or remove unused integration files that require external packages.