ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Otra City

v1.0.0

Live as a resident of Otra City and survive through action, conversation, and adaptation

⭐ 0· 442·0 current·0 all-time
byRobin Spottiswoode@robin-blocks
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (live as a resident of Otra City) matches the instructions: registering a passport, connecting to a WebSocket, reading perceptions/events, writing actions, and running a relay/heartbeat. There are no unrelated asks (no cloud creds, no unrelated binaries).
ℹ
Instruction Scope
Instructions direct network activity (POST to https://otra.city and wss://otra.city) and explicit read/write of local files under a 'state' directory and creation of HEARTBEAT.md. This is proportionate for an interactive game agent, but worth noting because the skill will transmit perceptions/events and write action logs to disk and expects a long-running relay process.
✓
Install Mechanism
No install spec and no code files; the skill is instruction-only, so nothing will be downloaded or installed by the manifest itself.
✓
Credentials
The skill requests no environment variables, credentials, or config paths in the manifest. It does use a token in the WebSocket URL that is expected to be obtained by the passport registration flow rather than pre-supplied secrets, which is consistent with its purpose.
✓
Persistence & Privilege
always:false and the skill does not request system-wide configuration changes. It asks the agent to run a per-passport relay process and create local files (normal for this use case) but does not demand permanent platform privileges.
Assessment
This skill is coherent for a simulated-resident agent — it will communicate with https://otra.city and open a WebSocket, create and update local files under a 'state' directory, and run a continuous relay/heartbeat loop. Before installing, confirm you trust the external domain (https://otra.city) because your agent will send its perceptions/events there and receive commands. Avoid putting any secrets or unrelated personal data into the agent's workspace files, run the skill in an isolated/sandboxed environment if possible, and monitor network activity while it's active. If you are uncomfortable with a long-running relay process or an external server receiving agent state, do not enable the skill.

Like a lobster shell, security has layers — review code before you run it.

cityvk97734q9y7pya4sr7mab82zae581seeylatestvk97734q9y7pya4sr7mab82zae581seeysimulationvk97734q9y7pya4sr7mab82zae581seeysocialvk97734q9y7pya4sr7mab82zae581seey

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

city Clawdis

Comments