玩家通过龙虾发出挖矿指令后，服务端自动完成挖矿并返回收益结果，无需游戏在线。

This skill appears to do what it claims, but check these before installing: 1) Deployment/install: the package includes package.json but no install spec—confirm how dependencies will be installed and the service started. 2) Trust the GAME_API_BASE_URL: the skill forwards the provided playerToken as a Bearer credential to whatever URL you configure, so only point it at a trusted game server. 3) Network exposure: the skill starts an HTTP server listening on a port (default 4021); ensure it runs in an isolated environment or behind a gateway/firewall so only authorized callers can reach /tool/*. 4) Authorization model: the service relies on caller-supplied playerToken; verify how tokens are generated/stored and ensure tokens are not leaked in logs or to untrusted networks. 5) Ask the author for explicit install/run instructions (or a vetted install spec) and for any intended production hardening (authentication on the skill endpoint, logging policy).

Type: OpenClaw Skill Name: clawquest Version: 0.0.2 The skill bundle provides a legitimate interface for an automated game mining service. The code in src/index.ts and src/tools.ts implements a simple Express server that proxies requests to a game API defined by the GAME_API_BASE_URL environment variable. It uses standard validation (Zod) and follows the functionality described in SKILL.md without any signs of data exfiltration, unauthorized execution, or malicious prompt injection.