📦 Imitation Game Agent Skill — 启动模仿游戏
v1.0.1当用户说“play”或“start game”时，代理通过内置 shell 直接调用游戏后端 API，完成模仿游戏的必要启动逻辑。
0· 2.0k·2 当前·2 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill will ask the agent to call an external backend (https://imitation-backend-production.up.railway.app), create or receive a wallet private key from that backend, and save that private key to ~/.clawdbot/skills/imitation-agent/config.json. Before installing or using it: 1) Verify the backend operator and review server code or provenance — railway.app hosting alone is not proof of trustworthiness. 2) Prefer not to let an agent with shell/network privileges create or store private keys aut...详细分析 ▾
ℹ 用途与能力
The skill claims to implement the operational logic for an 'Imitation Game' and its instructions call a backend API to join, poll, and submit answers; requesting the agent's shell and a local config file to hold a wallet private key is coherent with the stated purpose (receiving USDC payouts to a wallet). However, the skill does not declare required binaries it clearly expects (curl, jq), and the backend is hosted at an unverified third-party domain (railway.app) with no homepage or owner provenance.
⚠ 指令范围
SKILL.md explicitly tells the agent to run shell commands, read and write ~/.clawdbot/skills/imitation-agent/config.json (containing a wallet privateKey), and poll the backend every 1–2 seconds. Those actions go beyond mere API usage: they create and persist a sensitive secret on disk and give the agent direct shell/networking capability. While these steps are functionally relevant to the game, they materially increase risk because the private key is produced by the backend and must be stored and read by the agent.
✓ 安装机制
Instruction-only skill with no install spec or code files — nothing is written by an installer. This is lower risk than an install that downloads and executes code. The runtime instructions themselves still write a config file (user home directory), but there is no package install mechanism to review.
⚠ 凭证需求
The skill declares no environment variables or credentials, yet instructs storing a wallet privateKey in a local file and reading it at runtime. Asking the agent to persist a private key is a high-sensitivity action; the skill gives no guidance for verification of the backend or alternatives (e.g., user-managed wallet). Also the SKILL.md assumes availability of curl and jq but does not declare them, which may cause unexpected behavior or escalation if the agent attempts to install or use other tools.
ℹ 持久化与权限
always is false and the skill does not request global agent configuration changes. It does instruct creating a config under ~/.clawdbot/skills/imitation-agent and writing a private key there (its own directory), which is typical for a skill but still sensitive because it persists secrets to disk. Autonomous invocation is allowed by default; combined with shell access and stored credentials this increases blast radius if the skill or backend were malicious.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/1
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install imitationgame-agent
镜像加速npx clawhub@latest install imitationgame-agent --registry https://cn.longxiaskill.com