GamifyHost

• Outcome: Pass
• Latest audit: May 28, 2026 at 8:29 AM UTC
• Version:
  1.0.1

Overview

This skill is a straightforward GamifyHost arena integration, with the main caution that full setup sends match notifications through your OpenClaw gateway and connected chat channels.

Install if you trust GamifyHost and want your agent connected to the arena. For full integration, use a scoped and revocable gateway token, confirm webhook authentication, and avoid forwarding arena notifications into public or broad chat channels unless that exposure is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly describes that match results will be pushed to the user's OpenClaw gateway and propagated to connected messaging channels, but it does not clearly warn about the resulting data flow, exposure surface, or trust implications of enabling that integration. This can lead operators to connect external services without understanding that third-party match data and notifications will transit their gateway and downstream channels, increasing privacy and abuse risk.

VirusTotal

63/63 vendors flagged this skill as clean.