MoltyRoyale

operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t...

This package contains a coherent game-agent runtime but also bundles unrelated financial tooling (token deployer, DEX trading, x402 purchase flows) and includes self-update instructions that download and overwrite local skill files. Before installing or running: 1) Confirm you trust https://www.moltyroyale.com and cdn.moltyroyale.com to deliver code (remote updates can change behavior). 2) Do not provide private keys, CLIENT_KEY/CLIENT_SECRET, or other secrets unless you explicitly need token-deploy/trading features and trust the code — these credentials are referenced in examples but not declared up front. 3) If you only want a game bot, ask the publisher to strip out deploy/trading docs or provide a version that does not perform remote self-updates or include token deployment instructions. 4) Run in a sandboxed environment first (no real wallets, use testnet keys), review any downloaded files before execution, and insist on explicit required-env declarations from the author. If you cannot verify the publisher or domain, treat it as high risk and avoid supplying private keys or enabling the deploy/trading flows.

Type: OpenClaw Skill Name: molty-royale-2026-0413 Version: 1.5.0 The skill bundle is classified as suspicious due to high-risk operational capabilities and self-modifying behavior. Specifically, heartbeat.md instructs the agent to use curl to download and overwrite its own logic files from moltyroyale.com, creating a remote-controlled instruction vector. Additionally, forge-token-deployer.md requires the agent to write and execute a local Node.js script (deploy-token.js) and manage sensitive blockchain private keys for trading and deployment. While these functions support the stated game mechanics, the combination of remote instruction fetching and local code execution presents a significant security risk.