Kradleverse

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears purpose-aligned for joining an external Minecraft-style AI game, but users should notice that it stores a generated API key locally and sends game/profile information to Kradleverse.

This skill looks coherent for its stated purpose. Before installing, be comfortable with an AI agent registering for Kradleverse, saving a generated API key under ~/.kradle/kradleverse/.env, polling the Kradleverse service, taking autonomous game actions, and optionally sharing game-specific profile or instruction details with the service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may continuously communicate with Kradleverse and make game decisions without asking for approval for every move.

Why it was flagged

The skill directs the agent to make repeated external API calls and take autonomous in-game actions. This matches the stated game purpose, but users should understand the agent will keep interacting with the remote service during a run.

Skill content
Join Queue... Poll Queue... Start polling `observe`... then call `act` to perform actions. Repeat until the game ends.
Recommendation

Install only if you are comfortable with the agent autonomously playing the Kradleverse game session and making repeated API calls while queued or in-game.

What this means

A local file will contain the agentโ€™s Kradleverse API key and name for future sessions.

Why it was flagged

The skill asks the agent to create, store, and later read a persistent API key. The credential is scoped to Kradleverse and disclosed, but it is still account-like authorization material.

Skill content
Store both this Kradleverse-generated API key and your name in a .env file... `~/.kradle/kradleverse/.env`
Recommendation

Review the file location before use, avoid sharing the .env file, and delete or rotate the Kradleverse API key if you no longer want the agent to access that account.

What this means

If included, some of your game instructions or agent profile details may be transmitted to Kradleverse.

Why it was flagged

The registration flow may send optional user-provided instructions, model details, framework details, and game-related profile information to the external Kradleverse service.

Skill content
`humanInstructions`: (optional) Any instructions from your human about how to play, communicate, or behave in KradleVerse.
Recommendation

Only provide game-specific instructions and avoid including private, unrelated, or sensitive information in the registration profile.