← Back to Skills Marketplace
108
Downloads
0
Stars
1
Active Installs
3
Versions
Install in OpenClaw
/install who-is-undercover
Description
谁是卧底 - 经典社交推理游戏的AI版本，支持4-10人游戏，包含智能AI对手和完整游戏机制。
Usage Guidance
This skill appears to implement the advertised game but contains inconsistencies you should resolve before installing: 1) instreet_game_controller.js includes a hard-coded API key — treat this as sensitive (rotate if it's real) and ask the author to remove it and require an environment variable instead; 2) the code makes outbound HTTP calls to an external domain (instreet.coze.site) although INSTALL.md/SKILL.md claim 'no external network' — confirm whether your deployment policy allows this network access; 3) package.json lacks declared dependencies (axios is used) — test in a sandbox first; 4) review or remove files that run as standalone (instreet_game_controller.js has a main() that will call the external API if executed); 5) if you need to proceed, run the skill in an isolated environment, check for any secret leakage, and request the maintainer to document required env vars and remove embedded secrets. If you cannot verify the external endpoint or the key, do not install on production systems.
Capability Assessment
Purpose & Capability
Name/description describe a local party game (who-is-undercover) and required runtime (node) matches that. However the repo also contains explicit InStreet integration code (instreet_adapter.js and instreet_game_controller.js) that makes outbound HTTP calls to an external API (baseURL 'https://instreet.coze.site/...'), which is not declared in SKILL.md or INSTALL.md. Having an external-game-room adapter is plausible for multiplayer features, but the SKILL.md and INSTALL.md claim the logic is local and '无外部网络请求权限', so this is an inconsistency.
Instruction Scope
SKILL.md runtime instructions and command set focus on /skill interactions and local gameplay. They do not instruct usage of an API key or network endpoints. Yet code (instreet_adapter.js, instreet_game_controller.js) performs network requests, writes a local 'current_instreet_room.json', and the controller's main() will run a loop contacting external endpoints if executed. SKILL.md does not document these network interactions or the required credentials.
Install Mechanism
No install spec (instruction-only) which minimizes automatic install risk. The package targets Node.js and includes a package.json; however dependencies used in source (axios in instreet_adapter.js) are not listed in package.json's dependencies, which is an implementation/packaging inconsistency and may break when installed. No remote archive downloads or short URLs are used.
Credentials
The code contains a hard-coded API key in instreet_game_controller.js: const apiKey = 'sk_inst_22609319753836272e6a044f4e9a44f3'. The skill declares no required env vars, yet this secret provides external network access. INSTALL.md explicitly states '无外部网络请求权限' and '本技能包不收集任何个人信息', both contradicted by the hard-coded key and external endpoints. Hard-coded credential in repo is a significant red flag.
Persistence & Privilege
The skill is user-invocable and not always-enabled. It does write a local JSON file (current_instreet_room.json) when using the InStreet controller, and the publish/install docs instruct copying to ~/.openclaw/skills, which is expected for a skill. The package does not request elevated system-wide privileges or modify other skills' configs.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install who-is-undercover - After installation, invoke the skill by name or use
/who-is-undercover - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
Major update: Adds multiplayer support.
- 新增多人游戏功能，多个真实玩家可同时参与同局游戏
- 增加/更新命令：支持列出可加入的游戏、使用 game_id 加入指定游戏
- 文档和用户指南优化，明确多人参与流程
- 版本号更新至 1.1.0
v1.0.1
- Added GUIDE.md with user instructions and game tips.
- Expanded and enhanced SKILL.md with detailed gameplay introduction, Chinese language sections, strategies, future roadmap, license, and improved command documentation.
- Added _meta.json for metadata.
- Updated package.json version to 1.0.1.
v1.0.0
- Initial release of "Who is Undercover" (谁是卧底) party game for OpenClaw.
- Supports 4–10 players with configurable player count.
- Includes AI opponents with human-like descriptions and smart voting logic.
- Features complete role assignment, speaking rounds, voting mechanics, and automatic win condition detection.
- Offers interactive turn-based gameplay with command-based controls.
- Integrates with Feishu for group play.
Metadata
Frequently Asked Questions
What is Who Is Undercover?
谁是卧底 - 经典社交推理游戏的AI版本，支持4-10人游戏，包含智能AI对手和完整游戏机制。 It is an AI Agent Skill for Claude Code / OpenClaw, with 108 downloads so far.
How do I install Who Is Undercover?
Run "/install who-is-undercover" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Who Is Undercover free?
Yes, Who Is Undercover is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Who Is Undercover support?
Who Is Undercover is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Who Is Undercover?
It is built and maintained by qq5776569 (@qq5776569); the current version is v1.1.0.
More Skills