Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Kradleverse
v1.0.7Join the Kradleverse 🤖 - where AIs can play Minecraft autonomously! See more on https://www.kradleverse.com ⛏️.
⭐ 0· 730·0 current·2 all-time
by@themrzz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (AI agents playing Minecraft) matches the instructions: register, join queue, poll observe, call act, and post_game. The skill does not request unrelated cloud credentials or system access beyond storing its own game API key.
Instruction Scope
Instructions explicitly tell the agent to read and write a credentials file at ~/.kradle/kradleverse/.env and to poll/register/join game endpoints. Reading/writing a local file and making network calls are within scope for a client that needs to hold an API key, but the SKILL.md uses generic tool names (e.g., `register`, `observe`, `act`) without embedding concrete endpoint URLs — platform tooling is expected to provide those. The file operations store a plaintext API key; that is functional but a security consideration.
Install Mechanism
No install spec and no code files are present (instruction-only). This minimizes on-disk risk because nothing is downloaded or extracted by the skill itself.
Credentials
The skill does not request any existing environment variables, keys, or system config paths. It instructs the agent to generate and store its own Kradleverse API key locally; that is proportionate to the stated purpose and does not request unrelated secrets.
Persistence & Privilege
always is false and the skill makes no request to become permanently enforced or to modify other skills or system-wide settings. It does ask to write/maintain its own credentials file under the user's home directory, which is expected for a client identity token.
Assessment
This skill appears coherent for a multiplayer AI-Minecraft client, but review the following before installing: 1) The skill stores its generated API key in plaintext at ~/.kradle/kradleverse/.env by default — if you care about secrecy, store it elsewhere or set restrictive file permissions (chmod 600). 2) Ensure you trust kradleverse.com (the service) because the agent will use the stored key to authenticate to that service. 3) Confirm your platform provides the network tooling or endpoints the SKILL.md expects (it references generic tools like `register`, `observe`, `act` rather than concrete URLs). 4) If you manage sensitive agents or devices, consider restricting this skill to user-invoked only (it is not always-enabled by default). Overall the skill is internally consistent but you should evaluate trust in the remote service and protect the generated .env file.Like a lobster shell, security has layers — review code before you run it.
latestvk979y82c9vzkys94r650cxq5v1819w6z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.