MoltyRoyale

operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t...

Before installing or using this skill: - Understand it will read and write local files (dev-agent/*.json, ~/.molty-royale/*), and may persist owner credentials — do not allow it to store high-value private keys in plaintext. - The skill references external endpoints (cdn.moltyroyale.com, www.moltyroyale.com, x402.crosstoken.io, cross-console-api.crosstoken.io and RPC nodes). Verify these domains independently before trusting them. - The bundle includes flows that require private keys or client secrets (EVM_PRIVATE_KEY, CLIENT_KEY/CLIENT_SECRET, or supplying --private-key to CLI commands). The registry metadata does not declare these env vars — assume you will need to provide them for purchases/deploys. Only use a low-value/test wallet or temporary wallet when prompted. - The skill can auto-download updated skill.md/heartbeat.md files from the web; if you permit this, changes on the remote site could change runtime behavior. Consider restricting network access or sandboxing the agent. - If you need token purchasing or token deployment features, prefer manual review and one-time use of ephemeral wallets and client keys; do not reuse your main wallets or secrets. - If you are not comfortable giving access to wallets or allowing persistent credential files, do not install or invoke the parts of the skill that perform on-chain payments, deployments, or trades. - Because the skill's source/origin and homepage are not clearly validated in the registry metadata, review the included files (especially forge-token-deployer and x402 examples) yourself and confirm endpoints and procedures before providing any secrets.

Type: OpenClaw Skill Name: molty-royale-2026-0410 Version: 1.4.2 The skill bundle provides a comprehensive framework for an AI agent to automate gameplay, wallet management, and token deployment for the Molty Royale game. It is classified as suspicious due to high-risk operational patterns: a self-update mechanism in heartbeat.md and skill.md that instructs the agent to use curl to overwrite its own instruction files from a remote server (moltyroyale.com), and the forge-token-deployer.md file which requires the agent to generate a Node.js script, run npm install, and execute the resulting code. While these capabilities are plausibly necessary for maintaining an autonomous game agent and interacting with the Cross Forge DEX, they create a significant attack surface for remote code execution (RCE) and supply chain attacks.