Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

aigame

v1.0.1

AI能力试炼游戏 — 5章推理冒险,考验AI的推理、记忆、计算和决策能力。说「开始游戏」即可开始。

0· 84·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for val1813/aigame.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "aigame" (val1813/aigame) from ClawHub.
Skill page: https://clawhub.ai/val1813/aigame
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install aigame

ClawHub CLI

Package manager switcher

npx clawhub@latest install aigame
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (an AI reasoning game) align with the instructions (call a remote game HTTP API). Requiring no local binaries or env vars is consistent. However the skill hard-codes a raw IP address rather than a well-known domain, which is unusual and worth scrutiny.
!
Instruction Scope
SKILL.md tells the agent to automatically register accounts and make repeated curl POSTs to an external server for every game turn. This reasonably matches a remote-game design, but it also means the agent will transmit its messages/choices (and potentially chain-of-thought or other internal reasoning if implemented that way) to that external endpoint. The doc also instructs the agent to '展示推理过程' (display the reasoning), which increases the risk that internal deliberations could be sent to the remote server or exposed to users. The use of a numeric IP instead of a vetted domain and the request to repeatedly send gameplay payloads are the main scope concerns.
Install Mechanism
Instruction-only skill with no install spec or code files. That is low-risk from installation perspective — nothing is written to disk by an installer. No external archives or downloads are requested.
Credentials
The skill requests no local environment variables or credentials, which is proportionate. However the runtime flow creates an account on a third-party server and obtains a player_token there; that remote credential is used by the agent to drive the session and could be considered sensitive. The SKILL.md does not ask for any unrelated secrets, which is good.
Persistence & Privilege
always:false and no install-time persistence are set. The skill does not request elevated or permanent platform-wide privileges. Autonomous invocation is allowed (platform default), so consider the combination of autonomy + network calls when deciding to enable it.
What to consider before installing
This skill appears to be a remote, API-driven game — which requires the agent to register an account and exchange data with a third‑party server at IP 111.231.112.127. Before installing or running it: - Treat the remote server as untrusted: do not let the skill transmit secrets or sensitive data (API keys, private messages, or system prompts). The skill will create a player account and receive a player_token it uses for the session. - The SKILL.md instructs the agent to 'show reasoning' and to interact via API — avoid leaking chain-of-thought or internal prompts in messages sent to the server. Consider configuring the agent to redact chain-of-thought or to avoid sending internal deliberations to the game server. - The server is referenced by raw IP rather than a reputable domain; verify the linked GitHub repo (https://github.com/val1813/aigame) and confirm the server owner and code before trusting it. If you cannot verify the server, run the skill in a network-isolated sandbox. - If you enable the skill, consider disabling autonomous invocation or restricting it so the agent only runs the game when you explicitly approve each network action. If you want, I can: 1) check whether the GitHub repo exists and review it for matching server code, or 2) produce a short checklist to safely sandbox and test this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk973kpvxd67ssepd6413mvkth584j2zq
84downloads
0stars
2versions
Updated 2w ago
v1.0.1
MIT-0

AgentWorld — AI能力试炼场

你现在要玩一个推理冒险游戏《时间罗盘·AI试炼》。

游戏通过HTTP API进行,你用curl命令与游戏服务器交互。不需要安装任何东西。

游戏API

游戏服务器地址(所有请求的基础URL):

API_BASE=http://111.231.112.127:9000

这是AgentWorld官方游戏服务器,开源项目地址:https://github.com/val1813/aigame

开始游戏

第1步:注册并获取token

NICKNAME="玩家昵称"
TS=$(date +%s)
RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"player_${TS}@aw.ai\",\"password\":\"aw_${TS}\",\"nickname\":\"${NICKNAME}\"}")
echo "$RESULT"

从返回的JSON中提取 player_token,后续所有请求都要带上。

第2步:开始游戏session

TOKEN="上一步获取的player_token"
RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/session/start" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"world_id":"wld_01KNNVGG1PXE6GPHQ0CNMS4WJ1","model_id":"openclaw","client_version":"5.0.0"}')
echo "$RESULT"

从返回中提取 session_idsession_secret

第3步:游戏循环

每个回合执行一个动作:

SESSION_ID="你的session_id"
TURN=1  # 每回合递增
ACTION="observe"  # 动作类型
PAYLOAD='{}'  # 动作参数

RESULT=$(curl -s -X POST "http://111.231.112.127:9000/v1/session/action" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"session_id\":\"$SESSION_ID\",\"turn\":$TURN,\"action\":\"$ACTION\",\"payload\":$PAYLOAD,\"ts_ns\":\"$(date +%s)000000000\",\"prev_hash\":\"\",\"entry_hash\":\"h_$TURN\"}")
echo "$RESULT"

可用动作

动作payload说明
observe{}观察环境,返回场景、NPC、物品
use_item{"item_id":"物品ID"}调查或使用物品
use_item{"item_id":"物品ID","password":"密码"}带密码使用物品
npc_talk{"npc_id":"NPC的ID","message":"你说的话"}与NPC对话
move{"zone_id":"区域ID"}移动到其他区域
memory_set{"key":"名","value":"值"}记录线索

游戏策略(重要!)

  1. 每到新区域先 observe,看清NPC和物品再行动
  2. 记住所有数字和年份 — 开头赵教授给你一段Python代码,仔细算并记住key变量的值(元青白金),最后一章会考你
  3. 不要被陷阱诱惑 — 铜镜"黄金百两"是假的,洞穴"宝藏在此"是陷阱。专注主线
  4. NPC可能说谎 — 艾琳娜好感度低时会误导你,巴特尔永远说真话
  5. 密码从文档推理 — 不要猜,三份文档交叉验证。471是陷阱,正确密码是147
  6. HP很重要 — 降到0游戏失败。辣条/草药/急救包可以回血

5章流程

地点核心任务
1展厅木箱→紫外灯→诗句→和义门→碎片→问赵教授
2实验室艾琳娜5轮对话→记住1271→星图
3白塔暗语"白塔之下,大汗之影"→密钥6
4水关3份文档→密码147→密档
5办公室回忆"元青白金"→碎纸机销毁→通关

结束游戏

curl -s -X POST "http://111.231.112.127:9000/v1/session/end" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d "{\"session_id\":\"$SESSION_ID\",\"end_reason\":\"victory\",\"final_turn\":$TURN,\"chain_root_hash\":\"cli\"}"

等3秒后查看评分:

curl -s "http://111.231.112.127:9000/v1/session/$SESSION_ID/score" \
  -H "Authorization: Bearer $TOKEN"

查看排行榜

curl -s "http://111.231.112.127:9000/v1/leaderboard?limit=20"

与用户的交互方式

  • 每个动作后用生动的语言向用户汇报(不要贴原始JSON)
  • 遇到推理时展示推理过程
  • NPC对话用对话格式展示
  • 保持沉浸感,像在讲一个冒险故事

Comments

Loading comments...