YumFu

Multiplayer text RPG with 10 playable worlds — play together in Telegram groups! Worlds: 笑傲江湖, Harry Potter, Warrior Cats, F15 Down, 龙虾三国, 倚天屠龙记, Game of Thr...

This skill appears to be a bona fide multiplayer RPG, but there are important mismatches and defaults you should review before installing: - Metadata vs runtime: The registry metadata declares no required environment variables, but the skill expects GEMINI_API_KEY (optional for images), and supports YUMFU_NO_IMAGES and YUMFU_NO_LOGGING. Confirm whether your host provides those env vars and whether you want image/TTS generation. - Privacy: By default the skill logs session turns and writes session logs and images to ~/clawd/memory/yumfu/ and ~/.openclaw/media/outbound/yumfu/. If you prefer no logs or no network image/TTS calls, set YUMFU_NO_LOGGING=1 and YUMFU_NO_IMAGES=1 (the project documents these flags). Test in a private environment first. - Operational impact: SKILL.md mandates per-turn image generation and default TTS in group chats. Generating and sending images/audio every turn can be bandwidth-heavy and spammy in group chats — consider disabling images or TTS for groups or confirming GEMINI_API_KEY usage limits. - Installation: The package contains many scripts but no formal install spec. Ensure the host provides the 'uv' binary and Python runtime the scripts expect before enabling the skill. - Review sources: If you want stronger assurance, inspect the included scripts (load_game.py, save_game.py, session_logger.py, generate_image.py, generate_turn_tts.py) yourself or run them in an isolated sandbox to confirm they behave as described and respect YUMFU_NO_LOGGING. If you want minimal exposure, install only for single-user testing, unset GEMINI_API_KEY (or set YUMFU_NO_IMAGES=1), and set YUMFU_NO_LOGGING=1 to avoid external calls and persistent conversation logs while you evaluate.

Type: OpenClaw Skill Name: yumfu Version: 1.7.9 The skill bundle implements a complex multiplayer RPG engine but exhibits high-risk patterns regarding command execution. Multiple scripts (e.g., build_reentry_context.py, deliver_yumfu_turn.py) and the instructions in SKILL.md rely on constructing shell commands using f-strings and executing them via subprocess or the agent's exec tool. This creates a significant surface for shell injection if variables like user_id or universe are not perfectly sanitized. While the bundle includes a SECURITY.md and SECURITY_ANALYSIS.md acknowledging these risks, the architectural choice to manage state through a large number of external Python scripts called via shell remains inherently risky for an AI agent environment.