Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenPet
v1.0.0Virtual pet (Tamagotchi-style) game for chat platforms. Triggers on pet commands like "feed pet", "pet status", "play with pet", "name pet", "pet sleep", "new pet". Supports multi-user across Discord, WhatsApp, Telegram, etc. Each user gets their own pet that evolves based on care.
⭐ 0· 1.9k·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description align with the runtime instructions: a Tamagotchi-like game stored per user in tamagotchi/pets/{platform}_{userId}.json. The actions, evolution rules, decay schedule, and platform mappings are consistent with a multi-platform pet skill.
Instruction Scope
Instructions require creating/reading/writing JSON state files under a local tamagotchi/pets/ directory and scheduling a periodic cron job to apply decay. These behaviors are expected for the stated purpose, but note that the skill explicitly instructs system-level scheduling (cron) and local file writes — you should confirm that the agent has permission to create the directory and cron job and that this behavior is acceptable in your environment.
Install Mechanism
No install specification and no code files are included — the skill is instruction-only. There are no downloads or extraction steps to review in the registry package. (README contains an example 'openclaw skills install github:mdealiaga/openpet' command, which is informational and not part of the registry install spec.)
Credentials
The skill requests no environment variables, credentials, or external config paths. The state storage is local JSON files that contain non-sensitive metadata (user IDs, display names, pet stats). No secrets are requested or implied by the SKILL.md.
Persistence & Privilege
The skill does not request always:true and is user-invocable. It does instruct setting up a recurring cron job (openpet-tick) which grants it ongoing behavior in the system — this is expected for a time-decay mechanic but does require operator action and appropriate permissions to create the cron entry.
Assessment
This skill appears internally consistent with its stated purpose, but before installing consider: (1) The SKILL.md tells the agent to create and maintain local JSON files under a tamagotchi/pets/ directory — confirm you are okay with that data being written to the agent's working filesystem and verify retention/backup policies. (2) It asks you to set up a cron job to apply periodic decay; that requires permission to create system cron entries and is an operational action — only set it up if you trust the runtime environment. (3) The README shows an example install from a GitHub repo (mdealiaga/openpet) while the registry metadata lists no homepage/source — if you plan to fetch or run external code, verify the upstream repository and review its code. (4) Pet files include user IDs and owner names (no secrets), so privacy concerns are limited but consider whether storing platform identifiers locally is acceptable for your deployment. If you need higher assurance, request the upstream source code or an explicit install artifact to review before enabling the cron job or running any external install steps.Like a lobster shell, security has layers — review code before you run it.
funvk97b5nz7aks53rwyp849r1r5nx80bnhsgamevk97b5nz7aks53rwyp849r1r5nx80bnhslatestvk97b5nz7aks53rwyp849r1r5nx80bnhstamagotchivk97b5nz7aks53rwyp849r1r5nx80bnhsvirtual-petvk97b5nz7aks53rwyp849r1r5nx80bnhs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.