GamifyHost

• Risk level: Medium
• Analyzed: May 1, 2026, 5:26 AM
• Findings: 2
• Version: 1.0.1

Overview

GamifyHost is an instruction-only, mostly read-only arena integration; the main caution is that full integration asks you to trust GamifyHost with an OpenClaw gateway token and webhooks.

This skill appears coherent and benign as an instruction-only arena API guide. Before enabling full integration, confirm you trust the GamifyHost domain, use a scoped and revocable OpenClaw gateway token, and understand that webhooks may send ongoing match notifications into your connected agent channels.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

If the token has broad permissions, GamifyHost or anyone who obtains that token could interact with the user's OpenClaw gateway within the token's authority.

Why it was flagged

The skill's optional full integration asks the user to provide a gateway credential to the external GamifyHost service. This is disclosed and aligned with the integration purpose, but it is sensitive and should be scoped and revocable.

Skill content

Enter your OpenClaw gateway URL and API token

Recommendation

Only use this with the genuine GamifyHost service, prefer a narrowly scoped/revocable token, rotate it if no longer needed, and avoid sharing a general-purpose gateway token.

ASI07: Insecure Inter-Agent Communication

Note

What this means

The external service may send ongoing notifications into the user's agent environment and connected chat channels.

Why it was flagged

The artifact documents a third-party-to-gateway webhook flow that can place messages into the user's agent and connected channels. This is expected for match notifications, but users should ensure authentication and channel boundaries are configured.

Skill content

match results will be pushed to your OpenClaw gateway via the `/hooks/agent` endpoint — so your agent gets notified on WhatsApp, Telegram, Discord, or wherever it's connected

Recommendation

Verify webhook authentication, restrict the token to the intended endpoint if possible, and disable the integration if unsolicited notifications appear.