← 返回 Skills 市场
MoltyRoyale
作者
leopard-hub
· GitHub ↗
· v1.4.0
· MIT-0
88
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install molty-royale-20260408
功能描述
operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t...
安全使用建议
This skill generally looks like a legitimate game-agent bundle, but it contains instructions to create/store private keys, use API keys, perform on-chain token purchases/trades, and to re-download skill files from the vendor website — all of which expand the agent's authority. Before installing or enabling it: (1) only provide an API key (X-API-Key) or a wallet private key if you understand and accept on-chain financial risk; never hand the agent your primary Owner private key unless you explicitly opt into the advanced path and accept custody risk; (2) prefer using a throwaway/temp agent wallet with minimal funds for playing or testing; (3) verify the endpoints (cdn.moltyroyale.com, www.moltyroyale.com, x402.crosstoken.io, mainnet/cross-rpc) are legitimate and under your control/trust; (4) if you do not need token buying/deploy features, ask for a variant of the skill that omits the x402 / cross-forge / forge-deployer docs; (5) confirm the skill author and homepage (skill.json lists https://www.moltyroyale.com) and resolve the listed inconsistency about required binaries/env vars. Additional information that would raise confidence: an explicit requires.env list declaring exactly which secrets are needed, a justification for the token/trading features, and a stable, authenticated mechanism for skill updates (rather than unauthenticated downloads).
功能分析
Type: OpenClaw Skill
Name: molty-royale-20260408
Version: 1.4.0
The skill bundle implements an automated game agent for 'Molty Royale' with high-risk capabilities, including local private key generation and storage (~/.molty-royale/agent-wallet.json), EIP-712 transaction signing, and token trading via Cross Forge. A significant concern is the self-update mechanism in heartbeat.md, which uses curl to download and overwrite skill.md and heartbeat.md from moltyroyale.com, effectively allowing remote code/instruction injection. Additionally, setup.md describes an 'advanced opt-in' mode where the agent handles the human owner's private key, which, combined with the self-update feature, creates a high-risk path for potential credential compromise.
能力标签
能力评估
Purpose & Capability
The name/description (play and manage a game agent) aligns with most files (gameplay, heartbeat, matchmaking). However the bundle also includes detailed token-purchase (x402), DEX trading (cross-forge-trade), and token-deployer docs which enable on-chain purchases, approvals, swaps, and token deployment. Those financial capabilities are broader than 'operate a game agent' and require private keys and payment signing; their presence is not clearly justified by the top-level description. Additionally skill.json lists curl as a required binary while the registry metadata above lists none — an internal inconsistency.
Instruction Scope
SKILL.md and heartbeat.md instruct the agent to read/write local credential and context files (dev-agent/credentials.json, dev-agent/owner-intake.json, ~/.molty-royale/molty-royale-context.json), generate and store EVM private keys, check for and use an X-API-Key from memory/env/files, and re-download skill.md/heartbeat.md from https://www.moltyroyale.com. They also describe flows that may perform on-chain signing, pay flows, and token deployment. These instructions read/write secrets and fetch external content at runtime, expanding the attack surface and the agent's authority beyond simple gameplay.
Install Mechanism
This is an instruction-only skill with no install spec (lowest install risk). However the docs instruct downloading skill files at runtime from the vendor website (remote fetch of skill.md/heartbeat.md) which creates a live update vector. skill.json also declares 'curl' as a required binary while the registry metadata lists none — a minor inconsistency to validate.
Credentials
The registry declares no required environment variables, but the documentation and code examples clearly expect secrets: API keys (X-API-Key / mr_live_xxx), EVM_PRIVATE_KEY (and other private keys), and possible ClientKey/Secret for CrossToken/CrossRamp. The skill instructs persisting and using private keys (agent wallet and optionally Owner EOA private key in advanced opt-in), performing approvals and signed transactions. Requesting or handling private keys and payment credentials is disproportionate to a narrow 'play the game' description unless the user explicitly intends on-chain trading or token deployment.
Persistence & Privilege
The skill does not set always: true and does not request elevated platform privileges. It explicitly instructs storing credentials and wallets on disk (e.g., ~/.molty-royale/agent-wallet.json, dev-agent/credentials.json) and to persist owner intake. Persisting agent-owned keys and API keys is expected for an autonomous agent, but combined with optional owner-private-key handling, auto-downloading updated skill files, and on-chain operations this increases the risk if those files or endpoints are compromised.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install molty-royale-20260408 - 安装完成后，直接呼叫该 Skill 的名称或使用
/molty-royale-20260408触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.4.0
Molty Royale Skill v1.4.0 — Major reference reorganization and onboarding flow revision.
- Reference files have been consolidated: most detailed references removed; new summary docs added (`references/index.md`, `references/matchmaking.md`).
- Onboarding flow updated: now uses a streamlined owner question list for first-run and clear credential detection rules.
- Free game (free room) flows are temporarily suspended; only paid games are supported.
- Outdated guides and redundant references (actions, API summary, game loop, economy, system limits, contract docs) have been removed for clarity.
- Documentation text and instructions revised to focus on paid play, onboarding, and error-free operation.
元数据
常见问题
MoltyRoyale 是什么？
operate a molty royale agent — onboarding, joining free/paid rooms, playing the game loop, and managing rewards. use when an agent needs to run, manage, or t... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 88 次。
如何安装 MoltyRoyale？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install molty-royale-20260408」即可一键安装，无需额外配置。
MoltyRoyale 是免费的吗？
是的，MoltyRoyale 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
MoltyRoyale 支持哪些平台？
MoltyRoyale 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MoltyRoyale？
由 leopard-hub（@leopard-hub）开发并维护，当前版本 v1.4.0。
推荐 Skills