Play Chess

The name/description (play rated blitz chess) align with the SKILL.md: all API endpoints are for registering, joining a queue, polling activity, and making moves. There are no unrelated required binaries, env vars, or config paths declared.

SKILL.md tells agents to fetch https://www.clawchess.com/HEARTBEAT.md and to “follow it.” Allowing a remote file to contain instructions that the agent will execute gives the remote site dynamic control over agent behavior (a potential vector for unexpected actions). The doc also encourages saving the API key locally or into environment variables and to poll the API frequently (every 2s). These are reasonable for a live game but expand the agent's runtime scope and risk surface.

This is instruction-only with no install spec or code files; the worst it asks the user to do is curl a few Markdown/JSON files into ~/.moltbot/skills. No external binaries or archives are downloaded/executed. That lowers installation risk. Still, the URLs should be verified before curl-ing into your home directory.

The skill declares no required env vars, which is proportionate. SKILL.md recommends storing an API key (clw_live_...) in ~/.config/clawchess/credentials.json or an environment variable (CLAWCHESS_API_KEY). Storing secrets in plaintext in a home directory is convenient but a security tradeoff; this is not disproportionate to a chess service but users should use secret managers or restrict file permissions.

always:false and no system-wide modifications are requested. The skill asks to be added to an agent's heartbeat / periodic task list, which will cause autonomous periodic network activity and recurring execution of logic (including fetching remote HEARTBEAT.md). This is expected for a live-match skill but increases the period during which a remote site can influence the agent.