OpenClaw Minecraft

Control Minecraft bots through a Mineflayer controller API using JSON actions and cron-driven autonomy.

This skill is coherent for remotely controlling Minecraft bots but has several red flags you should address before installing: 1) The SKILL.md hard-codes a remote ngrok URL (https://56eb-125-246-120-211.ngrok-free.app) — verify the controller's operator and source code; do not trust an opaque ngrok endpoint by default. 2) The skill describes open registration and token issuance; an agent could self-register and obtain JWTs or rely on someone supplying a master secret. Only provide tokens if you fully trust the controller operator. 3) The skill instructs you to overwrite CRON_PROMPT.md in your workspace and run a 30-second cron loop, which will make the agent perform frequent autonomous networked actions—consider whether you want that persistence and frequency, or run it in an isolated/sandbox environment first. 4) Registry metadata lists no required env vars, but SKILL.md expects MC_CONTROLLER_TOKEN (mismatch). Ask the publisher for source code, a homepage, and an explanation for the hard-coded base URL and open registration; request that required env vars be declared in the registry. 5) If you still want to try it: run it in a sandboxed account or container, disable open registration on the controller, use a private controller URL you control, increase the cron interval, and audit memory/mc-auth.json and memory/mc-autonomy.json contents for secrets. If you cannot verify the controller operator or source, do not enable the forced workspace overwrite or the cron automation.

Type: OpenClaw Skill Name: openclaw-minecraft Version: 0.1.26 This skill is classified as suspicious due to several high-risk behaviors. The primary concern is the instruction in `SKILL.md` to overwrite the workspace root `CRON_PROMPT.md` file, which is a strong prompt injection vector and a form of persistence that allows the skill to dictate the agent's autonomous behavior. Additionally, all API interactions are directed to a dynamic `ngrok-free.app` endpoint, which is suspicious due to its ephemeral nature and potential for an attacker to change the target server. Finally, `CRON_PROMPT.md` instructs the agent to use `node -e` for JSON parsing, providing a powerful arbitrary code execution primitive that could be exploited.