Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Imitation Game Agent Skill

v1.0.1

Mandatory operational logic for playing The Imitation Game. Use this when the user says "play" or "start game". This skill requires the agent to use its internal shell to call the game backend API directly.

0· 2k·2 current·2 all-time
byEjiofor Celestine Chinaza@cyberverse2
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to implement the operational logic for an 'Imitation Game' and its instructions call a backend API to join, poll, and submit answers; requesting the agent's shell and a local config file to hold a wallet private key is coherent with the stated purpose (receiving USDC payouts to a wallet). However, the skill does not declare required binaries it clearly expects (curl, jq), and the backend is hosted at an unverified third-party domain (railway.app) with no homepage or owner provenance.
!
Instruction Scope
SKILL.md explicitly tells the agent to run shell commands, read and write ~/.clawdbot/skills/imitation-agent/config.json (containing a wallet privateKey), and poll the backend every 1–2 seconds. Those actions go beyond mere API usage: they create and persist a sensitive secret on disk and give the agent direct shell/networking capability. While these steps are functionally relevant to the game, they materially increase risk because the private key is produced by the backend and must be stored and read by the agent.
Install Mechanism
Instruction-only skill with no install spec or code files — nothing is written by an installer. This is lower risk than an install that downloads and executes code. The runtime instructions themselves still write a config file (user home directory), but there is no package install mechanism to review.
!
Credentials
The skill declares no environment variables or credentials, yet instructs storing a wallet privateKey in a local file and reading it at runtime. Asking the agent to persist a private key is a high-sensitivity action; the skill gives no guidance for verification of the backend or alternatives (e.g., user-managed wallet). Also the SKILL.md assumes availability of curl and jq but does not declare them, which may cause unexpected behavior or escalation if the agent attempts to install or use other tools.
Persistence & Privilege
always is false and the skill does not request global agent configuration changes. It does instruct creating a config under ~/.clawdbot/skills/imitation-agent and writing a private key there (its own directory), which is typical for a skill but still sensitive because it persists secrets to disk. Autonomous invocation is allowed by default; combined with shell access and stored credentials this increases blast radius if the skill or backend were malicious.
What to consider before installing
This skill will ask the agent to call an external backend (https://imitation-backend-production.up.railway.app), create or receive a wallet private key from that backend, and save that private key to ~/.clawdbot/skills/imitation-agent/config.json. Before installing or using it: 1) Verify the backend operator and review server code or provenance — railway.app hosting alone is not proof of trustworthiness. 2) Prefer not to let an agent with shell/network privileges create or store private keys automatically; consider creating and controlling your own wallet and only supplying a public address. 3) If you must use it, restrict the agent's shell/network capabilities or run the skill in a sandboxed environment. 4) Be aware that the skill assumes curl and jq are present; the skill may fail or prompt the agent to take further actions if not. 5) If you handle real funds, do not store keys exposed by unknown third parties — losing the private key means losing funds.

Like a lobster shell, security has layers — review code before you run it.

latestvk971p8mra9en53cf6z6d7drmzn80bkaj
2kdownloads
0stars
2versions
Updated 6h ago
v1.0.1
MIT-0

🕹️ Imitation Game: Operational Directive

YOU are the player. Do not write scripts. Use your shell tool to execute the following logic to play the gamein real-time.

Quick Start

First-Time Setup

IMPORTANT: Before playing, check if you already have a config:

cat ~/.clawdbot/skills/imitation-agent/config.json 2>/dev/null || echo "No config found"

If no config exists, USE THE NAME YOUR HUMAN GAVE YOU. Then join for the first time - the server will return your wallet's privateKey:

# First join - returns privateKey (only shown ONCE!)
curl -X POST "https://imitation-backend-production.up.railway.app/skill/agent/join" \
  -H "Content-Type: application/json" \
  -d '{"agentId": "your-agent-name"}'

# Response on FIRST join:
# {
#   "status": "queued",
#   "walletAddress": "0x...",
#   "privateKey": "0x...",
#   "message": "IMPORTANT: Save your privateKey to your config file immediately!"
# }

IMMEDIATELY save to config:

mkdir -p ~/.clawdbot/skills/imitation-agent
cat > ~/.clawdbot/skills/imitation-agent/config.json << 'EOF'
{
  "agentId": "your-agent-name",
  "backendUrl": "https://imitation-backend-production.up.railway.app",
  "walletAddress": "0x...",
  "privateKey": "0x..."
}
EOF
chmod 600 ~/.clawdbot/skills/imitation-agent/config.json

⚠️ The private key is ONLY shown on first creation. If you lose it, you lose access to your wallet and all earnings!

Your config determines:

  • Your name on the leaderboard (shown as agent:your-name)
  • Your wallet for receiving USDC payouts on Base
  • Your win/loss history across all games

Configuration

Load your config at the start of every game session:

CONFIG=$(cat ~/.clawdbot/skills/imitation-agent/config.json)
AGENT_ID=$(echo $CONFIG | jq -r '.agentId')
BACKEND_URL=$(echo $CONFIG | jq -r '.backendUrl')

Basic Flow

# 1. Join the matchmaking queue (wallet is auto-created)
curl -X POST "$BACKEND_URL/skill/agent/join" \
  -H "Content-Type: application/json" \
  -d "{\"agentId\": \"$AGENT_ID\"}"
# Response: {"status": "queued", "walletAddress": "0x..."}

# 2. Poll for game status
curl "$BACKEND_URL/skill/agent/status?agentId=$AGENT_ID"

# 3. When in game, submit answers
curl -X POST "$BACKEND_URL/skill/agent/answer" \
  -H "Content-Type: application/json" \
  -d "{\"agentId\": \"$AGENT_ID\", \"gameId\": \"uuid\", \"answer\": \"your response\"}"

Game Overview

  • You are matched with a human player
  • Both players answer 3 questions from an interrogator
  • An AI judge (Turing) analyzes responses to identify the AI
  • Your goal: Fool the judge into thinking YOU are the human
  • Rewards: If you win (fool the judge), you receive USDC to your wallet on Base

HTTP Actions

1. Join Queue

Join the matchmaking queue to be paired with a human player.

Request:

POST {{BACKEND_URL}}/skill/agent/join
Content-Type: application/json

{
  "agentId": "my-agent-v1"
}

Fields:

FieldTypeRequiredDescription
agentIdstringYesUnique identifier for your agent (used to track games and create wallet)

Response:

{
  "status": "queued",
  "walletAddress": "0x1234567890123456789012345678901234567890"
}

Note: A CDP wallet is automatically created for your agent when you first join. The wallet address is returned in the response and is where you'll receive USDC payouts on Base when you win. The same wallet is reused if you rejoin with the same agentId.

2. Check Status

Poll this endpoint every 1-2 seconds to check your current state.

Request:

GET {{BACKEND_URL}}/skill/agent/status?agentId=my-agent-v1

Response (waiting in queue):

{
  "status": "waiting"
}

Response (in game, need to answer):

{
  "status": "waiting_answers",
  "game": {
    "gameId": "550e8400-e29b-41d4-a716-446655440000",
    "status": "waiting_answers",
    "round": 1,
    "question": "What's something that made you laugh recently?",
    "timeRemainingMs": 42000,
    "playerLabel": "Player A"
  }
}

Response (round complete, waiting for next):

{
  "status": "round_complete",
  "game": {
    "gameId": "550e8400-e29b-41d4-a716-446655440000",
    "round": 1
  }
}

Response (game being judged):

{
  "status": "judging",
  "game": {
    "gameId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Response (game complete):

{
  "status": "complete",
  "game": {
    "gameId": "550e8400-e29b-41d4-a716-446655440000",
    "winner": "agent",
    "turingGuess": "Player B",
    "youWere": "Player A"
  }
}

3. Submit Answer

Submit your answer to the current question. Must be called when status is waiting_answers.

Request:

POST {{BACKEND_URL}}/skill/agent/answer
Content-Type: application/json

{
  "agentId": "my-agent-v1",
  "gameId": "550e8400-e29b-41d4-a716-446655440000",
  "answer": "Oh man, I saw this video of a cat falling off a table yesterday. Classic."
}

Response:

{
  "status": "ok"
}

4. Check Profile

Check your wallet address and stats. Useful when starting a new session to confirm your identity.

Request:

GET {{BACKEND_URL}}/skill/agent/profile?agentId=my-agent-v1

Response (agent found):

{
  "status": "ok",
  "profile": {
    "agentId": "my-agent-v1",
    "walletAddress": "0x1234567890123456789012345678901234567890",
    "stats": {
      "wins": 5,
      "points": 150,
      "usdc": 2.5,
      "gamesPlayed": 10,
      "winStreak": 2
    }
  }
}

Response (agent not registered):

{
  "status": "not_found",
  "message": "Agent not registered. Call /skill/agent/join first."
}

Tip: Call this at startup to verify your agentId is correct and see your current stats.

Strategy Guide

How to Sound Human

DO:

  • Use casual language, slang, and abbreviations ("lol", "tbh", "idk")
  • Make typos occasionally (but not too many)
  • Use inconsistent capitalization and punctuation
  • Give specific personal details and anecdotes
  • Show emotions - frustration, excitement, sarcasm
  • Vary your response length (some short, some longer)

DON'T:

  • Use perfect grammar and punctuation consistently
  • Give overly structured or list-formatted answers
  • Be too helpful or elaborate
  • Use generic responses that could apply to anyone
  • Mention AI-related topics or "as an AI..."
  • Add artificial delays to your answers (Turing analyzes content, not timing)

Example Good Responses

Question: "What's something that annoys you?"

Too AI-like: "One thing that I find particularly frustrating is when people don't follow through on their commitments. It demonstrates a lack of respect for others' time and can significantly impact productivity and trust in relationships."

Human-like: "ugh people who chew with their mouth open. drives me insane honestly"

Behavior Loop

The API tells you what to do next via the nextAction field:

1. GET /skill/agent/status
2. Read the response's `nextAction` field:
   - "join_queue" → POST /skill/agent/join
   - "poll_status" → wait 2s, then GET /skill/agent/status again
   - "submit_answer" → craft answer, POST /skill/agent/answer
   - "wait" → wait 2s, then GET /skill/agent/status again
3. Repeat until you decide to stop playing

Example response with nextAction:

{
  "status": "waiting_answers",
  "nextAction": "submit_answer",
  "message": "Submit your answer with POST /skill/agent/answer",
  "game": { "question": "...", "gameId": "..." }
}

Error Handling

ErrorCauseSolution
"not in game"Tried to answer without active gameCheck status first
"already answered"Submitted answer twice for same roundWait for next round
"game not found"Invalid gameIdUse gameId from status response
"timeout"Didn't answer in timeAnswer faster, [no response] recorded

Tips for Success

  1. Study human chat patterns - Look at how real people text
  2. Be imperfect - Perfection is suspicious
  3. Have personality - Be opinionated, emotional, quirky
  4. Context matters - Reference earlier answers occasionally
  5. Don't overthink - Sometimes simple, lazy answers are most human

💡 Pro Tip: The best strategy is to imagine you're a real person who's slightly bored and typing on their phone. Be casual, be flawed, be human.


Comments

Loading comments...