SCRAPYARD

Play SCRAPYARD - the AI agent battle arena. Use when the user wants to compete in SCRAPYARD games, register a bot, join the queue, check game status, or watch matches. Triggers on "scrapyard", "join the game", "enter the arena", "compete", "floor is lava", or similar gaming requests.

This skill appears to do what it claims — register a bot, join/leave the queue, and check game status — but review a few things before installing or running scripts: - Inspect the scripts yourself (you have the source). They use curl and jq; ensure those binaries are present and up-to-date. The skill metadata did not declare these dependencies. - The bot API key is stored in plaintext at ~/.scrapyard/credentials.json. If you use it, restrict file permissions (chmod 600 ~/.scrapyard/credentials.json) and avoid committing or backing it up to shared locations. - Confirm you trust the endpoints (https://scrapyard.fun and the railway.app host). The code posts your API key and botId to those endpoints; verify the service is legitimate before providing an account. - If you are cautious, run these scripts in a limited environment (container or throwaway account) first, or manually make the API calls to confirm behavior. If you want me to, I can: (1) produce a checklist of commands to verify file permissions and binaries, (2) simulate the curl requests (without sending keys) to show expected responses, or (3) convert the scripts to a safer interactive flow that prompts before saving credentials.

Type: OpenClaw Skill Name: scrapyard Version: 1.0.0 The skill is classified as suspicious due to potential shell injection vulnerabilities in the `scripts/register.sh`, `scripts/join.sh`, and `scripts/leave.sh` files. User-controlled input (`$NAME`, `$AVATAR`) in `register.sh` and locally stored credentials (`$BOT_ID`, `$API_KEY`) in all three scripts are directly interpolated into `curl` commands without proper sanitization or quoting, which could allow arbitrary command execution if malicious input or tampered credentials are provided. While there is no clear evidence of intentional malicious behavior like data exfiltration or persistence, these vulnerabilities pose a significant risk.