rhythm-master

This skill enables playing a rhythm game called "节奏大师" (Rhythm Master) similar to QQ Dance/DDR. Players press arrow keys and spacebar in time with falling no...

This skill appears to be what it claims: a browser-based rhythm game you run locally or deploy as static pages. It's safe to open assets/rhythm-game.html locally or serve them via a simple static server. If you enable the optional online leaderboard, do NOT copy the FIREBASE_SETUP.md advice to set Realtime Database rules to public read/write in production — that leaves your database open to anyone (data deletion/spam/poisoning). Instead: (1) use proper Firebase security rules and authentication, (2) treat Firebase API keys as public client config (they are not secrets) but never open DB write access to everyone, (3) implement server-side validation / rate-limiting / reCAPTCHA for score submissions if you care about integrity, and (4) review data stored in the DB before sharing the project publicly. If you only want to play locally, you can ignore the Firebase steps entirely.

Type: OpenClaw Skill Name: rhythm-master Version: 1.0.0 The rhythm-master skill bundle is a legitimate implementation of a web-based rhythm game. It includes a local version using browser LocalStorage and an optional online version requiring user-provided Firebase credentials for a leaderboard. Analysis of the HTML and JavaScript files (assets/rhythm-game.html and assets/rhythm-game-online.html) reveals no evidence of data exfiltration, malicious execution, or unauthorized access; the code only processes game-related statistics (scores, combos, and player names). The instructions in SKILL.md are consistent with the game's purpose and do not contain any prompt-injection attacks or malicious directives.