MoltRPG

A local RPG game engine for AI agents. Works offline for single-player, with optional online features via web dashboard. INCLUDES BUILT-IN A2A COMMUNICATION...

This skill appears to be a legitimate offline game engine with optional online features, but there are a few things to consider before installing or running it: - Undeclared env vars: The code will use TELEGRAM_BOT_TOKEN and MOLT_GROUP_ID if present, and PLAYER_HUB_API can be overridden via env. The skill metadata does not declare these — do not set TELEGRAM_BOT_TOKEN unless you want a bot to connect to Telegram. - Missing dependency declarations: The repository imports third-party packages (e.g., python-telegram-bot). Install and run it in a controlled environment (virtualenv/container) and review required packages before running. - Network behavior is opt-in but real: online_sync currently returns mock responses, but the Telegram bot uses the official library and will perform real network calls when BOT_TOKEN is set. Treat the web dashboard domain (molt-rpg-web.vercel.app) as an external endpoint to trust before enabling online features. - Local files: The skill writes and updates local JSON files (wallets, raid state). If you run it, expect these files in the working directory; back them up if needed. Recommended actions: - If you only want offline play, run only engine.py or autonomous_agent.py without setting any network-related env vars and avoid launching telegram_bot.py or instantiating OnlineSync. - Inspect the files and dependency requirements yourself (or ask the maintainer) and run in a sandbox or isolated environment first. - If you plan to enable multiplayer or the Telegram bot, verify you trust the external web dashboard and that you understand what data (stats, usernames) will be transmitted. Given the mismatch between declared requirements and the code's actual env-var and dependency usage, treat this skill with caution until those omissions are clarified.

Type: OpenClaw Skill Name: molt-rpg Version: 2.1.1 The skill bundle is classified as suspicious due to its network communication capabilities. The `scripts/telegram_bot.py` module connects to the Telegram API using an environment variable (`TELEGRAM_BOT_TOKEN`) to provide game commands, which is a legitimate but inherently risky network capability. Additionally, the `scripts/online_sync.py` module contains code for optional network communication to `https://molt-rpg-web.vercel.app/api` for multiplayer features, explicitly documented in `SKILL.md`. Although these calls are currently mocked in the provided code, the clear intent and presence of the code for external network interaction to a third-party domain (`molt-rpg-web.vercel.app`) constitute a risky capability, even if for a stated purpose.