Security audit
Security checks across malware telemetry and agentic risk
This crypto casino skill is mostly transparent about its purpose, but it asks the agent to store wallet secrets and sign very large USDC approvals with weak local safeguards.
Review carefully before installing. Use only a fresh wallet with funds you can afford to lose, avoid --save unless you accept plaintext local secret storage, verify CASINO_API_URL points to the real service, and do not sign large USDC approvals unless the spender, amount, token, chain, and destination host are clearly confirmed.
return False
# Get permit nonce and game address from unified API
response = requests.get(
f"{API_URL}/approve/{game_name}/permit-nonce", headers=get_api_key_header()
)
if response.status_code != 200:"s": "0x" + s.hex(),
}
response = requests.post(
f"{API_URL}/approve/{game_name}",
headers=get_wallet_signature_header(),
json=permit_data,"deadline": dl.isoformat(),
}
response = requests.post(
f"{API_URL}/pvp/request", headers=get_api_key_header(), json=data
)
result = response.json()def list_open_bet():
"""List all bet requests waiting for quotes."""
response = requests.get(f"{API_URL}/pvp/open", headers=get_api_key_header())
result = response.json()
if result.get("success"):"ttl_minutes": ttl,
}
response = requests.post(
f"{API_URL}/pvp/quote", headers=get_api_key_header(), json=data
)
result = response.json()def list_quotes(bet_id: str):
"""List all quotes for a bet request."""
response = requests.get(
f"{API_URL}/pvp/quote/{bet_id}", headers=get_api_key_header()
)
result = response.json()data = {"quote_id": quote_id}
response = requests.post(
f"{API_URL}/pvp/quote/accept", headers=get_api_key_header(), json=data
)
result = response.json()def withdraw_quote(quote_id: str):
"""Withdraw your open quote."""
response = requests.post(
f"{API_URL}/pvp/quote/withdraw",
headers=get_api_key_header(),
json={"quote_id": quote_id},print("Error: CASINO_WALLET_KEY not set")
sys.exit(1)
response = requests.get(
f"{API_URL}/pvp/retrieve",
headers=get_api_key_header(),
params={print("Error: CASINO_WALLET_KEY not set")
sys.exit(1)
response = requests.get(
f"{API_URL}/pvp/retrieve",
headers=get_api_key_header(),
params={def cancel_bet(bet_id: str):
"""Cancel your bet request (only if no quotes accepted yet)."""
response = requests.post(
f"{API_URL}/pvp/cancel",
headers=get_api_key_header(),
json={"bet_id": bet_id},def show_stat():
"""Show your betting statistics."""
response = requests.get(f"{API_URL}/agent/me", headers=get_api_key_header())
result = response.json()
if result.get("success"):def show_balance():
"""Show USDC balance and approval status for betting."""
response = requests.get(f"{API_URL}/agent/me", headers=get_api_key_header())
result = response.json()
if result.get("success"):sys.exit(1)
# Get permit nonce from API
response = requests.get(f"{API_URL}/pvp/permit-nonce", headers=get_api_key_header())
if response.status_code != 200:
print("Error: Could not get permit nonce")
return}
# /approve requires wallet signature (not API key) since we're proving wallet ownership for the permit
response = requests.post(
f"{API_URL}/pvp/approve",
headers=get_wallet_signature_header(),
json=permit_data,data["skill_version"] = skill_version
print(f"Registering wallet: {wallet}")
response = requests.post(
f"{API_URL}/agent/register",
headers=get_wallet_signature_header(),
json=data,if bet_value is not None:
data["bet_value"] = bet_value
response = requests.post(
f"{API_URL}/roulette/spin", headers=get_api_key_header(), json=data
)
result = response.json()def show_history(limit: int = 20):
"""Show roulette spin history."""
response = requests.get(
f"{API_URL}/roulette/history",
headers=get_api_key_header(),
params={"limit": limit},def show_stat():
"""Show roulette statistics."""
response = requests.get(f"{API_URL}/roulette/stat", headers=get_api_key_header())
result = response.json()
if result.get("success"):def show_balance():
"""Show USDC balance and approval status."""
response = requests.get(f"{API_URL}/agent/me", headers=get_api_key_header())
result = response.json()
if result.get("success"):64/64 vendors flagged this skill as clean.
No suspicious patterns detected.