by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, documentation, and runtime instructions are consistent with a multiplayer/solo interactive game framework and do not request unrelated credentials or privileged system access.
评估建议
This skill appears to be what it claims: a game framework with persistent 'endless mode' implemented in included JS files. Before installing or enabling autonomous use, you may want to: 1) review the omitted source files for any network, child_process, or filesystem operations that access paths outside the skill directory (search for require('child_process'), http/https/net/socket usage, or fs.readFile on system paths); 2) confirm you are comfortable with the skill writing/reading its saves/ wor...详细分析 ▾
✓ 用途与能力
Name/description (interactive game framework with endless mode, card/combat/story systems) aligns with the provided source files (many JS modules implementing card system, combat, bosses, multiplayer, persistence, saves). No environment variables, binaries, or unrelated cloud credentials are requested.
ℹ 指令范围
SKILL.md focuses on game mechanics, commands, and endless-mode scheduling/persistence. It includes examples of cron-like scheduled tasks and world_state persistence (world_state.json) and admin commands for managing the world. Nothing in SKILL.md instructs the agent to read unrelated system files, access secrets, or transmit data to external endpoints. Note: SKILL.md and PUBLISH-GUIDE mention publishing via a CLI that uses browser auth — that is a publishing workflow, not runtime behavior, but it involves interactive login if the author publishes.
ℹ 安装机制
There is no install spec (instruction-only), which reduces install-time risk. However the package contains many source files and saves/JSON files — the absence of an install spec is not malicious but is a minor inconsistency to be aware of (the runtime will load these files when the skill is executed by the agent platform). No download-from-URL or external installer was specified.
✓ 凭证需求
The skill declares no required environment variables, no primary credential, and no special config paths. The code snippets shown operate on in-repo data structures and local JSON saves only, so requested privileges are proportionate to the described functionality.
✓ 持久化与权限
always is false and model invocation is enabled (default). The skill includes its own save files (saves/*.json) and describes persisting world_state, which is appropriate for an endless-mode game. It does not request system-wide configuration changes or modify other skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.1.02026/3/21
新增无尽模式：每日行动点系统、定时反馈机制、持久世界状态、管理员工具
● 无害
安装命令
点击复制官方npx clawhub@latest install kuuila-game
镜像加速npx clawhub@latest install kuuila-game --registry https://cn.longxiaskill.com