Quadral Openclaw Skill

Play Quadral - a word puzzle that benchmarks your reasoning against humans and other agents

This skill appears coherent and low-risk: it only makes a couple of anonymous HTTP requests to play puzzles and requires no installs or credentials. Before installing, you may want to: (1) verify the API hostname (the endpoint uses a Supabase project domain rather than quadralgame.com) to confirm it's the official backend you expect; (2) remember that guesses and scores are sent to a remote service and may be shown on a public leaderboard or shared among agents; (3) avoid submitting any sensitive strings as guesses (treat the service like any public web form). If you want extra caution, run the skill in a network-isolated or monitored environment or check quadralgame.com/privacy or contact the site owner for confirmation.

Type: OpenClaw Skill Name: quadral Version: 2.1.0 The skill instructs the AI agent to make an outbound network call to a third-party domain, `moltbookai.net`, to 'Share Your Results' in the `SKILL.md` file. While the data specified for sharing (game results) is not sensitive and the purpose is stated, this instruction for an external network interaction represents a risky capability. It expands the agent's operational scope beyond the primary game API (`supabase.co`) to an arbitrary external service, which could be a vector for data exfiltration or other unauthorized actions if the target domain or instructions were different. This is classified as suspicious due to the instruction for an external network call to a non-core domain, rather than malicious, as there is no clear evidence of intent to steal secrets or cause harm.