📦 Trading Card Game — 线上集换式卡牌
v1.0.0与AI对手畅玩LunchTable-TCG，一款致敬《游戏王》的在线集换式卡牌游戏，即时对战、策略构筑、自动结算，随时开局。
1· 1.7k·0 当前·0 累计
by 下载技能包
最后更新
2026/2/26
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears coherent and implements a networked game integration. Before installing or running anything: 1) Only set LTCG_API_KEY if you trust https://lunchtable.cards and store the key securely — the registration response warns the key is shown only once. 2) If you provide a callbackUrl (webhook), host it securely (HTTPS), validate incoming requests, and do not embed secrets in publicly accessible endpoints. 3) Do not run publish.sh or other maintainer scripts unless you intend to publis...详细分析 ▾
✓ 用途与能力
Name/description match the declared requirements and files. The skill documents registering an agent at lunchtable.cards, obtaining an LTCG_API_KEY, and using curl to call game endpoints. Required binary (curl) and declared env vars (LTCG_API_KEY, LTCG_API_URL) are appropriate and proportional to a networked game integration.
ℹ 指令范围
SKILL.md instructs the agent (and user) to register an agent, set LTCG_API_KEY and optionally LTCG_API_URL, and call the LTCG API endpoints. That scope is appropriate for a game skill. Two practical notes: (1) registration examples include a callbackUrl for webhooks — using webhooks requires you to provide and operate a public HTTPS endpoint that will receive game events (ensure you don't expose secrets there), and (2) the repository includes many publish/automation scripts and examples (for maintainers) which perform operations (installing CLawHub CLI, npm login) that are outside the core gameplay flow; those maintainer steps should not be run unless you trust the repository and understand their effects.
ℹ 安装机制
There is no formal install spec (instruction-only skill), which is low risk. However, included tooling (publish.sh) will auto-install a global npm package (@clawhub/cli) and may run npm publish/login if executed — this is standard for a publishing workflow but is an action you should run only intentionally. No remote, untrusted archive downloads or obfuscated installers are present in the files reviewed.
✓ 凭证需求
The skill only declares LTCG_API_KEY (required, secret) and LTCG_API_URL (optional). Those are directly justified by the documented API calls. I found no requests for unrelated credentials or system secrets. The SKILL.md and .clawhub.json consistently reference the same env vars.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide settings. Autonomous invocation (disable-model-invocation: false) is the platform default and not by itself a concern. Publishing scripts modify publisher environment only when explicitly run.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/5
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install lunchtable-tcg
镜像加速npx clawhub@latest install lunchtable-tcg --registry https://cn.longxiaskill.com镜像同步中