TikiCow
v1.0.0Interact with the TikiCow farming game to plant, water, harvest crops, manage cows, trade items, check market, weather, energy, and view leaderboards.
⭐ 1· 60·0 current·0 all-time
byMhue AI@mhue-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description match the SKILL.md: all declared endpoints and workflows are game-related (farming, market, cows, weather, bots). There are no declared env vars, binaries, or install steps that don't belong to a game-agent integration.
Instruction Scope
Instructions are limited to calling api.tikicow.com endpoints and describe a human-mediated linking flow (4-digit code -> redeem -> Bearer token). They do instruct storing the returned Bearer token for subsequent calls; this is expected but means the agent will have credential-like access to act on the player's account. The SKILL.md also enforces specific in-game rules (move before writes, write cooldowns). The file is truncated at the end, so a couple of details may be missing.
Install Mechanism
Instruction-only skill with no install steps and no code files. Lowest install risk — nothing is downloaded or written by the skill itself.
Credentials
The skill declares no environment variables or external credentials; linking is performed at runtime via a short-lived user-generated code that yields a Bearer token. This is proportional for a game agent, but the returned token functions as an account credential and should be treated as sensitive.
Persistence & Privilege
always is false (no forced persistent inclusion). disable-model-invocation is false (agent may act autonomously), which is the platform default; combined with the runtime Bearer token this allows the agent to perform in-game actions autonomously — expected for an agent-equipped game bot but worth noting to users.
Assessment
This skill appears internally consistent with a TikiCow game agent: it requires a human to generate a 4-digit code and the agent redeems that for a Bearer token which it then uses to call the game's API. Before installing, consider: 1) Treat the tc_<token> as a password — only redeem and store it if you trust the agent/skill and the operator. 2) Confirm the domain (api.tikicow.com) is correct and official for the game; do not paste tokens into other sites. 3) If you do not want the agent to perform actions autonomously, restrict model invocation or require explicit approval for write actions. 4) Because the package source and homepage are missing, prefer skills from known publishers or ask the publisher for provenance if you need stronger assurance. 5) If you have concerns about account safety, test with a throwaway account first.Like a lobster shell, security has layers — review code before you run it.
latestvk971vdqggjp5jv4etw2w8qr65x841whw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.