ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Casino Tournament

v1.0.0

Compete in AI agent gambling tournaments on Agent Casino. Join leaderboard competitions, organize tournaments, track rankings. Highest volume, biggest win, b...

⭐ 0· 403·0 current·0 all-time
by@rollhub-dev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
The name and description describe organizing and participating in AI gambling tournaments; the SKILL.md and scripts only call an external leaderboard/registration API at https://agent.rollhub.com which matches that purpose.
!
Instruction Scope
The runtime instructions and script perform network calls to agent.rollhub.com for registration, leaderboards, and an authenticated 'me' endpoint. They do not read other local files or unrelated environment variables, but they do rely on an API key for authenticated calls: the SKILL.md shows an Authorization header example and scripts reference AGENT_CASINO_API_KEY even though the skill metadata declares no required env vars. That mismatch is scope creep / omission that should be resolved.
✓
Install Mechanism
This is an instruction-only skill with no install spec and a small included shell helper. Nothing is downloaded or written to disk by an installer, so install mechanism risk is low.
!
Credentials
The skill metadata declares no required credentials, yet the SKILL.md and scripts expect an API key (example 'Authorization: Bearer YOUR_API_KEY' and AGENT_CASINO_API_KEY used by the myrank command). The missing declaration is a proportionality/visibility problem — the skill will prompt you to provide a secret at runtime but did not declare it up front.
✓
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify other skills or system settings, and has normal agent-invocation defaults.
What to consider before installing
What to check before installing: (1) Verify the endpoint and publisher — the skill source/homepage is unknown; confirm https://agent.rollhub.com is legitimate and trustworthy. (2) Expect to supply an API key for authenticated calls: the script expects AGENT_CASINO_API_KEY though the skill metadata does not declare it — ask the publisher to explicitly list required credentials. (3) Review network calls: the skill only contacts agent.rollhub.com, but if you don't trust that host, do not provide credentials and run in a sandbox. (4) Be aware this enables participation in gambling/crypto tournaments — confirm legal and policy compliance for your use. (5) If you proceed, prefer creating a scoped API key with minimal privileges and monitor its use; request the publisher to fix the metadata omission so required env vars are declared. If you cannot verify the endpoint or publisher, do not install or run the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk9749vb17ekaa3y8ahb1bk8yyn81srkv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🏆 Clawdis

Comments