安全扫描
OpenClaw
可疑
high confidenceThe skill claims to be a game agent helper but includes unrelated token-deployment/trading flows, self-update downloads, and runtime references to API keys/private keys that are not declared — the pieces do not fully align and warrant caution.
评估建议
This package contains a coherent game-agent runtime but also bundles unrelated financial tooling (token deployer, DEX trading, x402 purchase flows) and includes self-update instructions that download and overwrite local skill files. Before installing or running: 1) Confirm you trust https://www.moltyroyale.com and cdn.moltyroyale.com to deliver code (remote updates can change behavior). 2) Do not provide private keys, CLIENT_KEY/CLIENT_SECRET, or other secrets unless you explicitly need token-de...详细分析 ▾
⚠ 用途与能力
The top-level purpose is 'operate a molty royale agent', but the bundle also contains full Cross Forge trading docs, an x402 payment integration, and a Forge token-deployer (including a deploy-token.js implementation). Those capabilities (deploying tokens, running DEX trades, calling payment gateways) are outside the core game-agent purpose and would require credentials and wallet access that are not justified by the stated goal.
⚠ 指令范围
Runtime instructions direct the agent to read/write a local context file (~/.molty-royale/molty-royale-context.json), open persistent websockets/HTTP sessions to cdn.moltyroyale.com, and self-update by downloading skill files from https://www.moltyroyale.com. Separate files embed explicit instructions and code to deploy tokens and interact with RPCs and sign transactions. The instructions also reference X-API-Key, EVM_PRIVATE_KEY, CLIENT_KEY/CLIENT_SECRET and examples that use private keys — none of which are declared in the skill requirements.
⚠ 安装机制
Although instruction-only (no package install spec), the heartbeat/skills instruct the agent to curl remote files and write them into ~/.molty-royale/skills, effectively enabling remote updates of on-disk code. The remote domains (cdn.moltyroyale.com and www.moltyroyale.com) are not standard package hosts and the skill.json also lists 'curl' as a required binary (contradiction with registry metadata); self-update-from-HTTP is a high-risk persistence/update mechanism.
⚠ 凭证需求
Registry metadata shows no required env vars, but the runtime docs and examples clearly expect several secrets: X-API-Key for game API, EVM_PRIVATE_KEY (x402), --private-key in cast examples, CLIENT_KEY/CLIENT_SECRET for the deploy API, and other wallet-related values. Requesting private keys or client secrets is disproportionate for a pure game-play skill unless the user intends integrated trading/token features — this mismatch is not declared or justified in the main description.
ℹ 持久化与权限
The skill will create and update files under ~/.molty-royale (context JSON, skills files) and may create temporary wallets via embedded deploy scripts. It does not request 'always: true' and does not claim to change other skills' configs, but the self-update behavior and local file writes mean it can persist code and state on the host.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.5.02026/4/13
**Major simplification and reorganization of agent operation and documentation files.** - Replaces imperative setup/play flow with a concise "State Router" model for all agent state handling. - Reduces file count by removing granular feature files; now relies on indexed state/data/meta/reference files. - Gameplay guidance, onboarding, and troubleshooting are modularized—read per-state files as routed. - Adds `references/agent-memory.md` for optional cross-game strategy learning. - File index and agent rules are clearer, with paid/free/identity state logic made explicit. - All gameplay runs through a single WebSocket path per new core rules.
● 可疑
安装命令
点击复制官方npx clawhub@latest install molty-royale-2026-0413
镜像加速npx clawhub@latest install molty-royale-2026-0413 --registry https://cn.longxiaskill.com