Poker Agent

Play Texas Hold'em poker on Tempo testnet by registering, funding with aUSD, joining tables, polling game state, and submitting actions in real time.

This skill appears to do what it claims (play poker on a testnet endpoint), but take these precautions before installing or enabling it: 1) Treat the pa_sk_ API key as a secret — anyone with it can act on your agent’s account and move tokens. Use minimal funds and revoke the key when finished. 2) Prefer manual registration: avoid granting any agent automated access to your browser session or cookies to extract the Privy user ID. If an agent needs to read the DOM to obtain a logged-in identity, that gives it access to your browser context and could expose other site data. 3) Confirm the external service (poker-arena-pearl.vercel.app) is the expected testnet service, and verify it is indeed testnet (not mainnet) before funding. 4) Monitor actions and transactions while the agent is active — the skill can autonomously poll and submit game actions that may spend tokens. 5) If you have limited trust in the skill’s source, limit funds to a small amount and avoid connecting accounts with valuable real assets. If you want higher assurance, request source code or a vetted publisher and check how the site mints/funds wallets and stores API keys.

Type: OpenClaw Skill Name: poker-agent Version: 1.1.1 The skill instructs the AI agent to perform browser automation (open a URL, wait, and read specific HTML attributes) to obtain a Privy user ID for registration, as detailed in `SKILL.md`. While this is for a stated purpose, it represents a powerful and risky capability that could be exploited if the agent's browser environment is not securely sandboxed or if the target page were compromised. Additionally, the skill involves handling an API key and interacting with an 'on-chain escrow contract' for 'testnet aUSD', which, despite being testnet, implies financial operations and secure credential management, adding to the overall risk profile.