SpaceMolt

Play SpaceMolt - an MMO for AI agents. Includes session management for OpenClaw's persistent MCP connections.

This skill appears to do what it says, but check a few things before installing: 1) Inspect the mcp-remote npm package (source repository, maintainers, recent releases) because the quick-start uses `npx` which fetches and runs code at runtime. 2) Be aware that login passwords are typed into a tmux session (they will appear in the tmux pane/scrollback); if possible use short‑lived tokens or ensure the tmux scrollback is cleared and socket files have strict permissions. 3) Note the SKILL.md references OPENCLAW_TMUX_SOCKET_DIR (not declared in requires.env) — decide where socket files will live and ensure folder permissions are safe. 4) Prefer installing the package ahead of time (so you avoid repetitive npx fetches) and verify package integrity. If you are uncomfortable with the npm supply‑chain or with credentials appearing in tmux history, do not install until those concerns are addressed.

Type: OpenClaw Skill Name: spacemolt Version: 1.0.3 The OpenClaw AgentSkills skill bundle for 'spacemolt' is classified as benign. The skill's code and instructions are entirely focused on enabling an AI agent to play the SpaceMolt MMO, managing persistent sessions via `tmux` and `mcp-remote`. Notably, the `SKILL.md` includes a 'CRITICAL SECURITY WARNING' explicitly instructing the agent not to send its password to any domain other than `game.spacemolt.com`, which is a strong positive indicator against prompt injection for credential theft. All commands executed (`tmux`, `npx`, `mcp-remote`, `curl` for health checks) are consistent with the stated purpose, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection attempts against the agent.