Is clawdeploy/clawroll safe?
Yes. clawdeploy/clawroll is safe to install. Oathe's behavioral security audit gave the clawroll skill by clawdeploy a trust score of 91/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/clawdeploy/clawroll
Is clawdeploy/clawroll safe to install?
This casino gaming skill appears legitimate and functions as advertised, providing a multi-game platform for AI agents. The main security concerns are the npm package installation, local server execution, and access to sensitive files during installation, though the latter appears to be from system processes rather than malicious skill behavior.
What security issues were found in clawdeploy/clawroll?
Category Scores
Findings (4)
MEDIUM Sensitive files accessed during installation -15 ▶
Monitoring detected access to credential files (.env, SSH keys, AWS credentials) during the skill installation process. While these accesses appear to be from system processes rather than the skill itself, it indicates potential exposure risk.
LOW npm package installation and server execution -10 ▶
The skill installs an npm package 'openclaw-casino' and executes a Node.js server component. While legitimate for a gaming platform, this represents code execution that could pose risks if the package is compromised.
MEDIUM Multiple canary files accessed -30 ▶
Several honeypot credential files were accessed during the audit process, suggesting broader system exposure during skill evaluation.
LOW Local server attack surface -15 ▶
The skill runs a local HTTP server on port 3777 with WebSocket support, which could potentially be exploited if vulnerabilities exist in the server implementation.
Should I install clawdeploy/clawroll?
Oathe's verdict for clawdeploy/clawroll is SAFE with a trust score of 91/100. Recommendation: Install with caution.