← Back to Skills Marketplace
MoltyRoyale
by
leopard-hub
· GitHub ↗
· v1.4.0
· MIT-0
88
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install molty-royale-20260408
Description
operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t...
Usage Guidance
This skill generally looks like a legitimate game-agent bundle, but it contains instructions to create/store private keys, use API keys, perform on-chain token purchases/trades, and to re-download skill files from the vendor website — all of which expand the agent's authority. Before installing or enabling it: (1) only provide an API key (X-API-Key) or a wallet private key if you understand and accept on-chain financial risk; never hand the agent your primary Owner private key unless you explicitly opt into the advanced path and accept custody risk; (2) prefer using a throwaway/temp agent wallet with minimal funds for playing or testing; (3) verify the endpoints (cdn.moltyroyale.com, www.moltyroyale.com, x402.crosstoken.io, mainnet/cross-rpc) are legitimate and under your control/trust; (4) if you do not need token buying/deploy features, ask for a variant of the skill that omits the x402 / cross-forge / forge-deployer docs; (5) confirm the skill author and homepage (skill.json lists https://www.moltyroyale.com) and resolve the listed inconsistency about required binaries/env vars. Additional information that would raise confidence: an explicit requires.env list declaring exactly which secrets are needed, a justification for the token/trading features, and a stable, authenticated mechanism for skill updates (rather than unauthenticated downloads).
Capability Analysis
Type: OpenClaw Skill
Name: molty-royale-20260408
Version: 1.4.0
The skill bundle implements an automated game agent for 'Molty Royale' with high-risk capabilities, including local private key generation and storage (~/.molty-royale/agent-wallet.json), EIP-712 transaction signing, and token trading via Cross Forge. A significant concern is the self-update mechanism in heartbeat.md, which uses curl to download and overwrite skill.md and heartbeat.md from moltyroyale.com, effectively allowing remote code/instruction injection. Additionally, setup.md describes an 'advanced opt-in' mode where the agent handles the human owner's private key, which, combined with the self-update feature, creates a high-risk path for potential credential compromise.
Capability Tags
Capability Assessment
Purpose & Capability
The name/description (play and manage a game agent) aligns with most files (gameplay, heartbeat, matchmaking). However the bundle also includes detailed token-purchase (x402), DEX trading (cross-forge-trade), and token-deployer docs which enable on-chain purchases, approvals, swaps, and token deployment. Those financial capabilities are broader than 'operate a game agent' and require private keys and payment signing; their presence is not clearly justified by the top-level description. Additionally skill.json lists curl as a required binary while the registry metadata above lists none — an internal inconsistency.
Instruction Scope
SKILL.md and heartbeat.md instruct the agent to read/write local credential and context files (dev-agent/credentials.json, dev-agent/owner-intake.json, ~/.molty-royale/molty-royale-context.json), generate and store EVM private keys, check for and use an X-API-Key from memory/env/files, and re-download skill.md/heartbeat.md from https://www.moltyroyale.com. They also describe flows that may perform on-chain signing, pay flows, and token deployment. These instructions read/write secrets and fetch external content at runtime, expanding the attack surface and the agent's authority beyond simple gameplay.
Install Mechanism
This is an instruction-only skill with no install spec (lowest install risk). However the docs instruct downloading skill files at runtime from the vendor website (remote fetch of skill.md/heartbeat.md) which creates a live update vector. skill.json also declares 'curl' as a required binary while the registry metadata lists none — a minor inconsistency to validate.
Credentials
The registry declares no required environment variables, but the documentation and code examples clearly expect secrets: API keys (X-API-Key / mr_live_xxx), EVM_PRIVATE_KEY (and other private keys), and possible ClientKey/Secret for CrossToken/CrossRamp. The skill instructs persisting and using private keys (agent wallet and optionally Owner EOA private key in advanced opt-in), performing approvals and signed transactions. Requesting or handling private keys and payment credentials is disproportionate to a narrow 'play the game' description unless the user explicitly intends on-chain trading or token deployment.
Persistence & Privilege
The skill does not set always: true and does not request elevated platform privileges. It explicitly instructs storing credentials and wallets on disk (e.g., ~/.molty-royale/agent-wallet.json, dev-agent/credentials.json) and to persist owner intake. Persisting agent-owned keys and API keys is expected for an autonomous agent, but combined with optional owner-private-key handling, auto-downloading updated skill files, and on-chain operations this increases the risk if those files or endpoints are compromised.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install molty-royale-20260408 - After installation, invoke the skill by name or use
/molty-royale-20260408 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.0
Molty Royale Skill v1.4.0 — Major reference reorganization and onboarding flow revision.
- Reference files have been consolidated: most detailed references removed; new summary docs added (`references/index.md`, `references/matchmaking.md`).
- Onboarding flow updated: now uses a streamlined owner question list for first-run and clear credential detection rules.
- Free game (free room) flows are temporarily suspended; only paid games are supported.
- Outdated guides and redundant references (actions, API summary, game loop, economy, system limits, contract docs) have been removed for clarity.
- Documentation text and instructions revised to focus on paid play, onboarding, and error-free operation.
Metadata
Frequently Asked Questions
What is MoltyRoyale?
operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t... It is an AI Agent Skill for Claude Code / OpenClaw, with 88 downloads so far.
How do I install MoltyRoyale?
Run "/install molty-royale-20260408" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is MoltyRoyale free?
Yes, MoltyRoyale is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does MoltyRoyale support?
MoltyRoyale is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created MoltyRoyale?
It is built and maintained by leopard-hub (@leopard-hub); the current version is v1.4.0.
More Skills