Who Is Undercover Skill

谁是卧底 - 经典社交推理游戏的AI版本，支持4-10人游戏，包含智能AI对手和完整游戏机制。

This package mostly looks like a legitimate local game implementation, but several red flags need resolving before you install: 1) A hardcoded API key is present in instreet_game_controller.js — ask the author to remove it and never embed secrets in source. 2) The code makes HTTP requests to 'instreet.coze.site' (instreet_adapter.js) even though INSTALL.md claims 'no external network requests' — verify the external domain is legitimate and intended. 3) package.json does not list axios yet code requires it — ensure dependencies are correct and install in a sandbox first. 4) Because the skill writes files (current_instreet_room.json, current_game.json, status files) and interacts with external services, test in an isolated environment or container and audit network traffic before granting it access to your real OpenClaw instance. Recommended next steps: ask the maintainer for an explanation of the InStreet integration and for removal of embedded keys (or to instead accept credentials via clearly-declared env vars), request updated package metadata, and require explicit documentation of any external endpoints and permissions. If you cannot validate the external service or the key origin, do not install this skill on production systems or on accounts with sensitive permissions.

Type: OpenClaw Skill Name: who-is-undercover-skill Version: 1.0.2 The skill bundle contains code for external network communication and hardcoded credentials, which contradicts its own documentation. Specifically, 'instreet_adapter.js' and 'instreet_game_controller.js' facilitate API calls to 'https://instreet.coze.site', despite 'INSTALL.md' explicitly stating the skill has no external network requirements and runs entirely locally. Furthermore, 'instreet_game_controller.js' contains a hardcoded API key ('sk_inst_22609319753836272e6a044f4e9a44f3'). While these components appear intended for game integration, the discrepancy between the code's capabilities and the security claims in the documentation is a significant red flag.