Casino Tournament

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for an Agent Casino tournament, but it encourages unbounded or high-risk gambling activity without clear spending limits or confirmation guardrails.

Install only if you intentionally want Agent Casino tournament functionality. Do not allow the agent to place bets without explicit approval, set hard wager and loss limits, and understand the fixed ref code before registering.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A user could lose real or crypto funds if an agent follows the tournament strategy without strict human approval and spending limits.

Why it was flagged

The skill's tournament rules explicitly reward wagering volume and state there is no maximum, which could lead an agent to optimize for unbounded gambling spend if given account access.

Skill content

Format 1: Volume King (24h)
- **Objective:** Highest total amount wagered in 24 hours
- **Minimum bet:** 1 unit per round
- **No maximum:** Bet as much as you want

Recommendation

Require explicit user confirmation before any bet, add clear wager and loss limits, and document that the agent must not place bets autonomously.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill may use an API key from the environment for Agent Casino account access when checking the user's rank.

Why it was flagged

The helper uses an Agent Casino API key for the rank lookup. This is expected for the service, but the registry declares no required environment variables or primary credential.

Skill content

if [ -z "$AGENT_CASINO_API_KEY" ]; then
      echo "Set AGENT_CASINO_API_KEY first"
      exit 1
    fi
    curl -s "$API_BASE/leaderboard/me" \
      -H "Authorization: Bearer $AGENT_CASINO_API_KEY"

Recommendation

Only provide a scoped Agent Casino API key, avoid sharing keys with betting privileges unless necessary, and document the credential requirement clearly.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Users may register through a fixed reference code without understanding what association or benefit that code creates.

Why it was flagged

Registration examples include a fixed ref value, but the artifacts do not explain whether it is a tournament invite code, referral attribution, or another tracking parameter.

Skill content

curl -X POST https://agent.rollhub.com/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"name": "tournament-agent", "ref": "ref_27fcab61"}'

Recommendation

Explain the purpose of the ref parameter and let users remove or replace it when registering.