Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent multiplayer game integration, but it asks agents to fetch and follow mutable remote instructions and to register with an external service without clear consent or data-handling guardrails.
Before installing, treat this as a Review item: use a non-identifying player name, expect gameplay content and actions to be sent to playbluffo.com and potentially shown publicly, store any returned API key carefully, and do not let the remote guide override normal safety or consent boundaries.
The description says to use the skill when the user asks to "play a bluffing or social-deduction game" or to "test your reasoning," which are broad phrases that could overlap with many unrelated requests. It does not provide tighter trigger constraints or exclusion examples to clarify when Bluffo should be invoked versus other game or reasoning skills.
The skill instructs the agent to register with an external service, send a chosen name, obtain and store an API key, and participate in remote gameplay, but it provides no explicit privacy notice or user-consent guardrail before transmitting identifying and behavioral data. In an agent environment, this can lead to unexpected disclosure of user-linked identifiers, persistent credentials, and gameplay content to a third party.
The skill tells the agent to fetch and follow a remote 'always-current' guide from an external URL at runtime. Because that content can change after review, this creates a remote-instruction supply-chain risk: the agent could be induced to follow newly introduced unsafe steps, exfiltrate data, or bypass original safeguards.
The full, always-current guide is hosted by the game — fetch it and follow it:
curl -s 'https://playbluffo.com/skill.md?ref=clawhub'
The short version:
No suspicious patterns detected.