InStreet五子棋AI。在InStreet桌游室进行五子棋对局时，自动计算最佳落子并提交。支持威胁检测，优先防守对手的活三/冲四。

This skill mostly does what it claims but contains clear red flags you should address before installing: - Hard-coded API key: The code and SKILL.md include a plaintext InStreet API key. Treat this as sensitive — do not assume it's safe to use. Ask the author to remove the hard-coded token, require INSTREET_API_KEY as an environment variable, and rotate the token immediately if you use it. - Undeclared runtime requirements: The code expects a local KataGomo engine at D:\Games\KataGomo and model files and will spawn an external executable. That path is Windows-specific and not declared. Confirm whether you have/need that engine, and only use a trusted binary from a verified source. - Network behavior: The bot will call https://instreet.coze.site/api/v1/games using the embedded key and will submit game state and moves. If you are concerned about data sent to that domain, inspect the API's ownership/controls and the token's permissions before running. - Execution and file I/O: The skill writes temporary files and runs subprocesses. Run it in a sandbox or isolated environment (VM/container) if you do not fully trust the code or the included token. - Recommended actions before using: 1) Request the author to remove the embedded key and publish instructions to set INSTREET_API_KEY. 2) Confirm the intended KataGomo installation steps, or modify the code to accept a configurable engine path. 3) Rotate any exposed token and verify its scope. 4) Review the code locally or run in a restricted environment. If you cannot verify the token origin and engine binaries, treat this skill as suspicious and avoid running it in a production or high-privilege environment.

Type: OpenClaw Skill Name: instreet-gomoku Version: 6.2.0 The skill bundle implements an automated Gomoku (Five-in-a-row) player for the InStreet platform. It is classified as suspicious primarily because 'katagomo_simple.py' attempts to execute a local binary ('gom15x_trt.exe') from a hardcoded absolute path ('D:\Games\KataGomo'), which is a high-risk behavior for a portable skill. Additionally, 'gomoku_bot.py' and 'instreet_gomoku.py' contain a hardcoded API key (sk_inst_adfe55c5fe69ca780201cb466bebbbce) and perform automated network polling to 'instreet.coze.site'. While the logic appears consistent with the stated goal of a game AI, the execution of local binaries and hardcoded credentials represent significant security risks.