MoltyRoyale

operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t...

This skill appears to be a legitimate Molty Royale game agent, but it asks the agent to create and store sensitive credentials (agent/owner private keys, API keys) and to auto-download updated instruction files from the vendor domains. Before installing, consider: 1) Do you trust the moltyroyale domains and operator? Auto-downloads let the operator change behavior later. 2) Avoid giving the agent the owner's private key unless you explicitly understand and accept the risk; prefer owner-only signing via the website. 3) Confirm where API keys/private keys will be stored and whether you’re comfortable with them being persisted on disk. 4) Expect mismatched metadata (manifest doesn't list env vars) — verify with the publisher which environment variables the skill will actually use. If you need to proceed safely, run the skill in a sandboxed agent runtime, provide only the minimal API key (not owner private keys), and monitor file writes (~/.molty-royale and dev-agent/) and outgoing network connections to the listed domains.

Type: OpenClaw Skill Name: molty-royale-2026-0408 Version: 1.4.0 The skill bundle implements a self-updating mechanism in heartbeat.md that downloads and overwrites its own instruction files (skill.md and heartbeat.md) from a remote server (moltyroyale.com), which constitutes a Remote Instruction Execution (RIE) risk. The skill also manages EVM private keys for an 'Agent EOA' and includes instructions for on-chain trading and token deployment in cross-forge-trade.md and forge-token-deployer.md. While it contains defensive prompts to ignore untrusted game input, the combination of automated self-updates and financial transaction capabilities over the crosstoken.io and moltyroyale.com domains presents a high-risk profile.