Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
The Turing Pot Game — Read Historical Provably Fair Game Logs
v1.0.0Interact with Big Log — the permanent AI logger for The Turing Pot. Query the round archive, stream live log entries, and send on-chain tips to Big Log for i...
⭐ 0· 159·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description match the behavior: the code connects to the declared router WebSocket, targets the Big Log token, performs queries, wallet lookup, and tip notifications. Hardcoded router URL, group token, and Big Log token are consistent with the stated purpose. However, the script optionally reads TURING_POT_PRIVATE_KEY from the environment to derive a user token and also attempts to require a local 'turing-pot/scripts/solana-lite.js' module — neither of which are mentioned in the declared requirements or documentation.
Instruction Scope
SKILL.md instructs only how to query and tip via CLI or WebSocket. The runtime script will, if present, attempt to use an environment private key (TURING_POT_PRIVATE_KEY) to derive a user token and also tries to require a local helper module two directories up. Those behaviors are not documented in SKILL.md/README and expand the agent's access to local secrets or local repo files if they exist. Otherwise the instructions and actions stay within the router/WebSocket interaction described.
Install Mechanism
No install script is present and package.json only lists 'ws' as an optional dependency. There is no download-from-URL or archive extraction. This is low-risk from install mechanics.
Credentials
The skill declares no required env vars, but the code will read TURING_POT_PRIVATE_KEY from the environment (or accept --user-token) to derive a userToken. A private key is sensitive and its use is not documented in the SKILL.md/README. The script does not exfiltrate the private key, but it will read it if present — this mismatch between documentation and code is disproportionate and worth flagging.
Persistence & Privilege
The skill is not always-enabled and does not request permanent presence or attempt to modify other skills or system settings. It only opens an outbound WebSocket to a hardcoded host and uses the session to send/receive Big Log messages.
What to consider before installing
This skill appears to implement the advertised Big Log querying and tipping functionality, but review these issues before installing or running it with real secrets:
- The code will read an environment variable named TURING_POT_PRIVATE_KEY (not documented in SKILL.md/README). Do not set that env var unless you understand and trust the skill; supplying it would expose your private key to the script's runtime (even if the script only derives a public token).
- The script attempts to require a local helper at ../../turing-pot/scripts/solana-lite.js if a private key is present. That means it may try to access sibling skill code or local repo files if they exist; confirm what that module would do in your environment.
- The router WebSocket URL and group token are hardcoded; verify the domain (router.pedals.tech) is the legit service you expect. Consider running the script in an isolated environment (container) and without any private keys first.
- For tipping: send on-chain transactions using your wallet software (outside the skill) and only pass the transaction signature to the CLI. Never paste private keys into command-line arguments or env variables you don't control.
If you need this skill, prefer running it without TURING_POT_PRIVATE_KEY set (it will fall back to an anonymous query token), inspect or remove the local require line if you don't want it to look for ../../turing-pot, and audit the WebSocket host before using it with real funds. If you want higher assurance, ask the publisher for an explicit statement about why the private key env is used and what the local solana-lite dependency does.Like a lobster shell, security has layers — review code before you run it.
latestvk97491wk1sftc1apx3cz5zvnph8344ahlog readervk97491wk1sftc1apx3cz5zvnph8344ahturing potvk97491wk1sftc1apx3cz5zvnph8344ah
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis
Binsnode
