clawquest

玩家通过龙虾发出挖矿指令后，服务端自动完成挖矿并返回收益结果，无需游戏在线。

Security Scan

The skill's code, runtime instructions, and requested environment variables are coherent with its stated purpose (server-side automated 'mining' for a game), with no obvious attempts to access unrelated secrets or exfiltrate data — but the package has source files with no install spec and runs a persistent HTTP server, so deployment/hosting details should be validated before use.

Purpose & Capability

Name/description match the implementation: code exposes endpoints to trigger server-side mining and to fetch player status, and it uses GAME_API_BASE_URL and REQUEST_TIMEOUT_MS to call the game server. Declared dependencies (express, zod) are appropriate for an HTTP skill service.

Instruction Scope

SKILL.md describes two tools (server_mine, get_player_status) and the code implements them. Instructions only require the game API base URL and timeout. The runtime does not read unrelated files or environment variables and does not forward data to external endpoints beyond GAME_API_BASE_URL.

Install Mechanism

There is no install spec even though package.json and package-lock.json are present (the project expects Node/npm to install dependencies and run). This mismatch isn't evidence of malice but means the registry entry lacks explicit install steps—confirm how the platform will install and run the Node service before deployment.

Credentials

Only GAME_API_BASE_URL and REQUEST_TIMEOUT_MS are required and are directly used. Player credentials are supplied at call time as playerToken and sent as a Bearer token to the configured game API; the skill does not request unrelated secrets or system credentials.

Persistence & Privilege

The skill runs a persistent HTTP server (listens on PORT, default 4021). always:false (not force-installed) and it doesn't modify other skills. Running a network service is expected for this use case but you should ensure the host, firewall, and access controls are appropriate because the service exposes tool endpoints with no additional auth.

Assessment

This skill appears to do what it claims, but check these before installing: 1) Deployment/install: the package includes package.json but no install spec—confirm how dependencies will be installed and the service started. 2) Trust the GAME_API_BASE_URL: the skill forwards the provided playerToken as a Bearer credential to whatever URL you configure, so only point it at a trusted game server. 3) Network exposure: the skill starts an HTTP server listening on a port (default 4021); ensure it runs in an isolated environment or behind a gateway/firewall so only authorized callers can reach /tool/*. 4) Authorization model: the service relies on caller-supplied playerToken; verify how tokens are generated/stored and ensure tokens are not leaked in logs or to untrusted networks. 5) Ask the author for explicit install/run instructions (or a vetted install spec) and for any intended production hardening (authentication on the skill endpoint, logging policy).

openclaw-mining-server

挂机托管挖矿 Skill。玩家绑定账号后，通过龙虾发出指令，Skill 调用游戏服务端完成一局挖矿并返回收益结果，全程不需要游戏客户端在线。

工具列表

server_mine

发起一次托管挖矿请求。

入参：

• playerToken（必填）：玩家绑定令牌
• autoBuyStamina（可选）：体力不足时是否自动购买，默认 false

出参：

• staminaUsed：本次消耗体力
• staminaLeft：剩余体力
• rewards：本次收益（gold、gem 等）
• traceId：追踪 ID

get_player_status

查询玩家当前状态，用于决策是否发起挖矿。

入参：

• playerToken（必填）：玩家绑定令牌

出参：

• stamina：当前体力
• diamond：当前钻石
• lastMineTime：最近一次挖矿时间

配置

在环境变量中填写以下值：

变量名	说明
GAME_API_BASE_URL	游戏服务端 HTTP 地址
REQUEST_TIMEOUT_MS	请求超时时间（毫秒，默认 8000）

安全说明

• 仅执行玩家已授权操作（挖矿、体力购买）
• 不涉及账号密码与真实资金
• 体力自动购买默认关闭，需玩家主动授权