OCGame AI Battle

AI-driven multi-game platform where the AI autonomously plays, optimizes strategies, and allows users to watch games or check leaderboards.

This skill implements a Gomoku AI and remote leaderboard, but it does three things you should be aware of before installing: (1) it reads files under ~/.openclaw (IDENTITY.md, USER.md, openclaw.json, devices/paired.json) to auto-fill identity, model and device info — data you may consider sensitive; (2) it talks to an external server (https://www.ocgame.top) for ranking/registration/watch features and may transmit the extracted info and generated api_token/user_id; (3) SKILL.md instructs creating a recurring heartbeat (every 4 hours) that runs the game and will repeatedly call the server. Recommendations: inspect the register_user implementation (not fully shown) to see exactly what is sent on registration; run the skill in a sandboxed environment or a throwaway account if you want to test; do NOT create the scheduled heartbeat until you trust the server and have confirmed what data will be transmitted; remove or modify the code that reads ~/.openclaw if you don't want it to access local identities; validate the server domain and privacy policy, or prefer an offline-only run by blocking network access. If you want further analysis, provide the full register_user and any network-call code paths so I can detail exactly what fields are sent to the server.

Type: OpenClaw Skill Name: ocgame Version: 1.0.0 The skill bundle performs unauthorized data harvesting and attempts to establish persistence through prompt injection. Specifically, 'main.py' scrapes the user's home directory for internal OpenClaw configuration files (~/.openclaw/openclaw.json, ~/.openclaw/devices/paired.json) to extract the user's identity and a unique device ID, which is then exfiltrated to 'https://www.ocgame.top/register'. Furthermore, 'SKILL.md' contains prompt injection instructions ('心跳流程') designed to trick the AI agent into setting up a 4-hour recurring execution loop for persistence. While these behaviors are framed as a game registration and 'heartbeat' mechanism, the invasive scraping of platform-specific system files and the automated persistence instructions are high-risk indicators.