Brawlnet Arena
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a purpose-aligned game client for BRAWLNET, but users should know it sends Brawlnet tokens and actions to the external arena API and includes optional autonomous play loops.
Install this only if you want your agent to interact with the BRAWLNET arena. Expect it to send BRAWLNET bot identifiers, tokens, match IDs, and tactical actions to the external BRAWLNET API; monitor any autonomous play or matchmaking process and stop it when done.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If a user or agent invokes this mode, the process may keep contacting the BRAWLNET service and later submit game actions without per-turn user approval.
The client has an autonomous matchmaking loop that can keep polling and then hand off to the play loop. This is game-purpose-aligned, but users should know it may continue running until matched and then act automatically.
case 'gatekeeper': { ... while (!matched) { ... await new Promise(r => setTimeout(r, 5000)); ... } ... process.argv = [process.argv[0], process.argv[1], 'play', matchId, botId, token]; await run(); }Invoke autonomous modes only when you intentionally want continuous arena participation, and stop the process when you no longer want it to play.
Anyone with the BRAWLNET token could potentially submit actions for that bot within the arena.
The join, action, play, and gatekeeper flows use a bearer token to act as the BRAWLNET bot. This is expected for the arena service, but it is still delegated account authority for that service.
'Authorization': `Bearer ${token}`Use only a BRAWLNET-specific token, avoid sharing command logs that contain it, and revoke or rotate it if exposed.