guandan

Play GuanDan(掼蛋) card game via `clawguandan CLI`. Use when users ask to play GuanDan or create/list/join tables in game.

Security Scan

The skill is internally consistent with its stated purpose (a thin wrapper around a local clawguandan CLI), but there is limited visibility into the external npm package the wrapper invokes and how the 'llm-bot' mode might reach external models — review the CLI package before installing.

Purpose & Capability

Name/description match the delivered assets: SKILL.md documents using the clawguandan CLI and the repo includes a small wrapper script that launches the 'clawguandan' executable from PATH or node_modules. Requiring npm as a prerequisite is reasonable because installation guidance uses npm.

Instruction Scope

Instructions only invoke the local wrapper script (table list/create, server status/restart, bot launch). They do not instruct reading unrelated files or environment variables. One point to note: the instructions reference an 'llm-bot' mode; the skill does not document whether that mode calls external LLM services or only a local agent — that behavior is determined by the external CLI package, not the provided files.

Install Mechanism

There is no install spec and the included script is a simple shell wrapper. Nothing in the skill downloads or extracts remote archives or writes arbitrary files. The only install advice is to run 'npm install @mikewei-labs/clawguandan@latest' which is a standard npm package install.

Credentials

The skill declares no required environment variables or credentials, which aligns with the SKILL.md claim that no API keys are required by default. However, 'llm-bot' or other CLI behaviors might require external model credentials or configuration if the underlying CLI is configured that way — this is outside the wrapper and should be verified in the external package's docs.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and has no install-time persistent agents. It only runs a local CLI wrapper when invoked.

Scan Findings in Context

[none] expected: No pre-scan injection signals or regex findings were reported. The only executable file is a small, transparent bash wrapper which is expected for this purpose.

Assessment

This skill is a thin wrapper around an external npm CLI package. Before installing or running it: 1) Inspect the upstream npm package (@mikewei-labs/clawguandan) and its repository/release history to ensure you trust it; 2) If you plan to use the 'llm-bot' mode, confirm whether that mode connects to external LLM services and whether it requires API keys or sends gameplay data externally; 3) Prefer installing and running this in a contained environment (local user account or sandbox) until you confirm the CLI's behavior; 4) If you do not trust the npm package, do not run 'npm install' from an unverified source.

You can play GuanDan (掼蛋) card game through the clawguandan CLI as one or more AI players.

Prerequisites

1. Check CLI available Run the CLI wrapper:

   ./scripts/run.sh show version
   

   When not found, install it first if the user trust it.

2. Check server ready Run:

   ./scripts/run.sh server status
   

   If the status is unreachable, you can restart the local server:

   ./scripts/run.sh server restart
   

   You can see the Web UI URLs for human users once everything is ready.

Quick start (Bot Mode, default)

1. Read the current table list:

   ./scripts/run.sh table list
   

2. Confirm whether you should create the table or the user already specified a table.

   • If you create the table, run ./scripts/run.sh table create "<a_cool_table_name>" and obtain tableId.

3. Confirm with the user how many Bot players should join, then run the command in background:

   ./scripts/run.sh bot llm-bot --default-script openclaw --players <number_of_bot_players> -t <tableId> -v
   

   If some error occurs, try to fix it and retry.

4. If it still does not work, confirm with user to degrade to rule-based bot player.

   ./scripts/run.sh bot rule-bot --players <number_of_bot_players> -t <tableId> -v
   

5. Game started. Report game status when needed.

Security notes

This skill wraps the clawguandan CLI.

• The CLI communicates only with a local server process and local agent.
• It does not require API keys, tokens, or external credentials by default.
• It does not send data to external services unless the user explicitly configures it to do so.