Play Any Game - AI游戏伴侣助手

AI游戏伴侣助手 - 当你在游戏中遇到困难、卡关、不知道怎么操作时，AI可以帮你分析游戏画面、解答问题、甚至简单操作界面帮你解决问题。不是全自动代肝，而是你的游戏伙伴，在你需要的时候伸出援手。当用户提到"帮我看下这个怎么过"、"这个怎么操作"、"卡关了"、"不知道怎么弄"时使用此技能。支持原神、崩坏星穹铁道等各类游戏。

Before installing, note these points: - Metadata mismatch: The skill's registry entry says no environment variables are required, but the documentation and code require an API key (DASHSCOPE_API_KEY). Confirm with the author why the registry omitted this requirement. - Privacy: The skill captures screenshots of your game window and (per docs) sends them to a cloud service (Aliyun GUI-Plus) for analysis. Do not use this skill if those screenshots might contain sensitive information you do not want uploaded. - API key handling: The skill stores the API key in a local config.json by default. Ensure that file is stored securely and not committed or shared. Consider using temporary keys or scoped accounts if possible. - Local control risk: The skill can move your mouse, send keystrokes, and perform background PostMessage clicks. That capability is necessary for automation but can affect other applications. Only run it on a machine/account where you accept this level of control. - Implementation oddities: The project uses the 'openai' Python client in requirements but documents Aliyun GUI-Plus as the provider. Review scripts/gui_agent/aliyun.py (network endpoints, upload behavior) to confirm where images and keys are actually sent. Also scan the code for TODOs or obvious bugs (there are at least some small code issues) before running. - Mitigations: Run initially in a controlled environment (non-critical account, VM, or sandboxed Windows user), inspect network traffic (to see which endpoints are used), and rotate API keys if you test the skill. If you need assurance, ask the maintainer to (1) update registry metadata to declare the API key requirement, (2) document exact endpoints used and whether images are persisted server-side, and (3) provide an option to run the recognition model locally or with a self-hosted endpoint.

Type: OpenClaw Skill Name: play-any-game Version: 1.4.1 The skill bundle provides an AI-powered game assistant that utilizes high-risk capabilities, including screen capture, window manipulation, and simulated mouse/keyboard input via Win32 APIs (implemented in scripts/screenshot.py, scripts/click.py, and scripts/keyboard.py). It exfiltrates screen data to a third-party endpoint (dashscope.aliyuncs.com) for multi-modal analysis using Aliyun's GUI-Plus model (scripts/gui_agent/aliyun.py). While these behaviors are consistent with the stated purpose of assisting players in games like Genshin Impact, the combination of remote screen monitoring and automated input control represents a significant security risk.