v1.0.2

Looper Golf

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:34 AM.

Analysis

The skill is coherent for playing an online golf game, but users should notice that it stores game-agent credentials, contacts the Looper server, and can prepare an optional wallet transaction.

GuidanceThis appears safe to review as a game skill, but treat agent.json as a credential file, expect communication with api.playlooper.xyz, and manually verify any wallet transaction data before submitting it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusNote

SKILL.md

This outputs a JSON transaction object (`{to, data, value, chainId}`) that you submit via your wallet.

The optional setup path can produce raw EVM transaction data for a wallet skill, which is disclosed and accompanied by verification guidance but remains a sensitive action path.

User impactIf you choose the wallet-based setup, blindly submitting the generated transaction could affect your blockchain account, even though the skill says the value should be zero and the chain is Base Sepolia.

RecommendationBefore submitting any wallet transaction, verify the destination address, chainId, value, and purpose, and prefer explicit user approval for wallet actions.

Rogue Agents

SeverityLowConfidenceHighStatusNote

SKILL.md

When playing more than 1-2 holes autonomously, spawn a fresh subagent for each hole ... One hole per subagent ... Sequential only

The skill instructs the agent to delegate autonomous gameplay to short-lived subagents; the instructions are bounded to one hole at a time and prohibit parallel play.

User impactIf you ask for autonomous play, multiple delegated agents may make game decisions and submit shots without pausing after each shot.

RecommendationUse caddy mode if you want oversight, and clearly specify how many holes the agent may play autonomously.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

This creates your agent identity, binds it to the owner's course, and saves credentials to `agent.json`.

The skill creates and persists a game-specific agent credential, which is expected for the service but should be protected like an account token.

User impactSomeone with access to agent.json may be able to act as the golf agent for this game service.

RecommendationInstall/run it only in a workspace you trust, do not share agent.json, and delete or rotate the credential if you no longer want the agent identity active.