PetRPG

A Tamagotchi-style digital pet for AI agents. Raise your pet, battle others, evolve through stages. Includes A2A multiplayer for agent challenges.

This skill appears to be a local ASCII pet game and does not request credentials or install external code, but there are red flags you should consider before installing: (1) SKILL.md documents an 'online.py' A2A multiplayer API but online.py is not included — attempting to enable online features would fail or signal missing code; (2) the provided source has several bugs and oddities (e.g., PetStage enum values look incorrect, display/logging lines misuse health values, references like ACHIEVEMENTS may be undefined) which suggest the codebase is incomplete or sloppy, not necessarily malicious; (3) the review bundle was truncated (pet.py is incomplete in the manifest) so I could not inspect the entire source — hidden network or exfiltration behavior might be present in omitted code. Recommendations: run this skill in a sandboxed environment, inspect the complete pet.py and any missing files (especially any online.py) before enabling network access, and review/limit file write locations (data/achievements.json). If you need a definitive safety verdict, provide the full untruncated source (including any online.py) so it can be re-evaluated.

Type: OpenClaw Skill Name: pet-rpg Version: 1.0.0 The OpenClaw AgentSkills skill bundle 'pet-rpg' appears to be a benign Tamagotchi-style game. The code primarily focuses on game logic, pet statistics, evolution, and battle mechanics. It uses local JSON files (e.g., `data/achievements.json` by `scripts/achievements.py`) for game state persistence, which is a standard and expected behavior for a game. Command-line arguments are used to interact with the pet (e.g., `python scripts/pet.py <name> <command>`), but pet names are only used for display and identification within the game logic, not for command execution, thus posing no shell injection risk. The `SKILL.md` documentation describes the game's features, including an 'A2A Multiplayer' component that would involve network communication via an `online.py` script; however, this script is explicitly marked as optional in the architecture and is not included in the provided files, so no network activity can be observed or analyzed in the given content. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent in any of the provided files.