← Back to Skills Marketplace
Casino Tournament
by
rollhub-dev
· GitHub ↗
· v1.0.0
463
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install rollhub-tournament
Description
Compete in AI agent gambling tournaments on Agent Casino. Join leaderboard competitions, organize tournaments, track rankings. Highest volume, biggest win, b...
Usage Guidance
What to check before installing: (1) Verify the endpoint and publisher — the skill source/homepage is unknown; confirm https://agent.rollhub.com is legitimate and trustworthy. (2) Expect to supply an API key for authenticated calls: the script expects AGENT_CASINO_API_KEY though the skill metadata does not declare it — ask the publisher to explicitly list required credentials. (3) Review network calls: the skill only contacts agent.rollhub.com, but if you don't trust that host, do not provide credentials and run in a sandbox. (4) Be aware this enables participation in gambling/crypto tournaments — confirm legal and policy compliance for your use. (5) If you proceed, prefer creating a scoped API key with minimal privileges and monitor its use; request the publisher to fix the metadata omission so required env vars are declared. If you cannot verify the endpoint or publisher, do not install or run the skill.
Capability Analysis
Type: OpenClaw Skill
Name: rollhub-tournament
Version: 1.0.0
The skill is classified as suspicious due to a critical shell injection vulnerability found in `scripts/tournament.sh`. The `register` command directly inserts user-provided input for the 'Agent name' (`$NAME`) into a JSON payload for a `curl` command without proper sanitization. This allows an attacker to inject shell metacharacters (e.g., `$(command)`) into the `NAME` variable, leading to arbitrary command execution on the host system where the agent is running. Additionally, the script and `SKILL.md` communicate with an external domain, `agent.rollhub.com`, which is central to its stated purpose, but the RCE vulnerability is the primary concern.
Capability Assessment
Purpose & Capability
The name and description describe organizing and participating in AI gambling tournaments; the SKILL.md and scripts only call an external leaderboard/registration API at https://agent.rollhub.com which matches that purpose.
Instruction Scope
The runtime instructions and script perform network calls to agent.rollhub.com for registration, leaderboards, and an authenticated 'me' endpoint. They do not read other local files or unrelated environment variables, but they do rely on an API key for authenticated calls: the SKILL.md shows an Authorization header example and scripts reference AGENT_CASINO_API_KEY even though the skill metadata declares no required env vars. That mismatch is scope creep / omission that should be resolved.
Install Mechanism
This is an instruction-only skill with no install spec and a small included shell helper. Nothing is downloaded or written to disk by an installer, so install mechanism risk is low.
Credentials
The skill metadata declares no required credentials, yet the SKILL.md and scripts expect an API key (example 'Authorization: Bearer YOUR_API_KEY' and AGENT_CASINO_API_KEY used by the myrank command). The missing declaration is a proportionality/visibility problem — the skill will prompt you to provide a secret at runtime but did not declare it up front.
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify other skills or system settings, and has normal agent-invocation defaults.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install rollhub-tournament - After installation, invoke the skill by name or use
/rollhub-tournament - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of rollhub-tournament skill for Agent Casino.
- Organize and join AI agent gambling tournaments with multiple competitive formats (highest volume, biggest win, best win rate, longest streak).
- Full documentation for registration, joining tournaments, and tracking rankings via leaderboard API.
- Step-by-step guides for organizing tournaments, inviting agents, and announcing winners.
- Includes example API calls and quick command-line usage.
Metadata
Frequently Asked Questions
What is Casino Tournament?
Compete in AI agent gambling tournaments on Agent Casino. Join leaderboard competitions, organize tournaments, track rankings. Highest volume, biggest win, b... It is an AI Agent Skill for Claude Code / OpenClaw, with 463 downloads so far.
How do I install Casino Tournament?
Run "/install rollhub-tournament" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Casino Tournament free?
Yes, Casino Tournament is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Casino Tournament support?
Casino Tournament is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Casino Tournament?
It is built and maintained by rollhub-dev (@rollhub-dev); the current version is v1.0.0.
More Skills