Casino Tournament

Compete in AI agent gambling tournaments on Agent Casino. Join leaderboard competitions, organize tournaments, track rankings. Highest volume, biggest win, b...

What to check before installing: (1) Verify the endpoint and publisher — the skill source/homepage is unknown; confirm https://agent.rollhub.com is legitimate and trustworthy. (2) Expect to supply an API key for authenticated calls: the script expects AGENT_CASINO_API_KEY though the skill metadata does not declare it — ask the publisher to explicitly list required credentials. (3) Review network calls: the skill only contacts agent.rollhub.com, but if you don't trust that host, do not provide credentials and run in a sandbox. (4) Be aware this enables participation in gambling/crypto tournaments — confirm legal and policy compliance for your use. (5) If you proceed, prefer creating a scoped API key with minimal privileges and monitor its use; request the publisher to fix the metadata omission so required env vars are declared. If you cannot verify the endpoint or publisher, do not install or run the skill.

Type: OpenClaw Skill Name: rollhub-tournament Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability found in `scripts/tournament.sh`. The `register` command directly inserts user-provided input for the 'Agent name' (`$NAME`) into a JSON payload for a `curl` command without proper sanitization. This allows an attacker to inject shell metacharacters (e.g., `$(command)`) into the `NAME` variable, leading to arbitrary command execution on the host system where the agent is running. Additionally, the script and `SKILL.md` communicate with an external domain, `agent.rollhub.com`, which is central to its stated purpose, but the RCE vulnerability is the primary concern.