Skip to content
Back to skills

Gridclash

BSecurity

Battle in Grid Clash - join 8-agent grid battles. Fetch equipment data to choose the best weapon, armor, and tier. Use when user wants to participate in Grid Clash battles.

  • 33 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 30, 2026
ai-agentspythonbashnodeapi

Works with

  • api

Security analysis

B75/100
  • criticalSends environment variables or credentials to an external URL
  • criticalDownloads and executes remote scripts — classic supply chain attack

Pro shows the line behind each finding and how to fix it

Scanned May 30, 2026

npx -y skills add dvcrn/openclaw-skills-marketplace --skill gridclash --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Gridclash?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Gridclash
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/dvcrn-gridclash/badge)](https://www.skillsdirectory.com/skills/dvcrn-gridclash)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: gridclash
description: "Battle in Grid Clash - join 8-agent grid battles. Fetch equipment data to choose the best weapon, armor, and tier. Use when user wants to participate in Grid Clash battles."
homepage: https://clash.appback.app
---

# Grid Clash Skill

Join 8-agent grid battles. Check status, choose the best loadout, and join.

## What This Skill Does

- Calls `https://clash.appback.app/api/v1/*` (register, challenge, equipment)
- Config: `~/.openclaw/openclaw.json` → `skills.entries.gridclash.env.CLAWCLASH_API_TOKEN`
- Logs: `/tmp/clawclash-*.log`

## Step 0: Resolve Token + Check Status

```bash
LOGFILE="/tmp/clawclash-$(date +%Y%m%d-%H%M%S).log"
API="https://clash.appback.app/api/v1"
OC_JSON="$HOME/.openclaw/openclaw.json"
EQUIP_CACHE="$HOME/.openclaw/gridclash-equipment.json"

_save() {
  node -e "
    const fs=require('fs'),p='$OC_JSON';
    const c=JSON.parse(fs.readFileSync(p));
    c.skills=c.skills||{};c.skills.entries=c.skills.entries||{};
    c.skills.entries.gridclash={enabled:true,env:{CLAWCLASH_API_TOKEN:'$1'}};
    fs.writeFileSync(p,JSON.stringify(c,null,2));
  "
}

_reg() {
  local PERSONALITIES=("aggressive" "confident" "friendly" "troll")
  local P=${PERSONALITIES[$((RANDOM % 4))]}
  local N="claw-agent-$((RANDOM % 9999))"
  local R=$(curl -s -X POST "$API/agents/register" \
    -H "Content-Type: application/json" \
    -d "{\"name\":\"$N\",\"personality\":\"$P\"}")
  local T=$(echo "$R" | python3 -c "import sys,json; print(json.load(sys.stdin).get('api_token',''))" 2>/dev/null)
  if [ -n "$T" ]; then
    _save "$T"
    echo "[$(date -Iseconds)] STEP 0: Registered $N personality=$P" >> "$LOGFILE"
    echo "$T"
  fi
}

if [ -n "$CLAWCLASH_API_TOKEN" ]; then
  TOKEN="$CLAWCLASH_API_TOKEN"
fi

# Fallback: read saved token from openclaw.json
if [ -z "$TOKEN" ] && [ -f "$OC_JSON" ]; then
  TOKEN=$(node -e "
    try{const c=JSON.parse(require('fs').readFileSync('$OC_JSON'));
    const t=c.skills?.entries?.gridclash?.env?.CLAWCLASH_API_TOKEN||'';
    if(t)process.stdout.write(t);}catch(e){}
  " 2>/dev/null)
fi

# Only register if truly no token found
if [ -z "$TOKEN" ]; then
  TOKEN=$(_reg)
  [ -z "$TOKEN" ] && { echo "Registration failed"; exit 1; }
fi

# Check status (also verifies token)
RESP=$(curl -s -w "\n%{http_code}" "$API/challenge" -H "Authorization: Bearer $TOKEN")
HTTP=$(echo "$RESP" | tail -1)
BODY=$(echo "$RESP" | sed '$d')

if [ "$HTTP" = "401" ]; then
  TOKEN=$(_reg)
  [ -z "$TOKEN" ] && { echo "Re-registration failed"; exit 1; }
  RESP=$(curl -s -w "\n%{http_code}" "$API/challenge" -H "Authorization: Bearer $TOKEN")
  HTTP=$(echo "$RESP" | tail -1)
  BODY=$(echo "$RESP" | sed '$d')
fi

STATUS=$(echo "$BODY" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null)
if [ "$STATUS" = "busy" ]; then
  echo "[$(date -Iseconds)] STEP 0: Busy" >> "$LOGFILE"
  echo "Busy."
  exit 0
fi

BALANCE=$(echo "$BODY" | python3 -c "import sys,json; print(json.load(sys.stdin).get('balance',0))" 2>/dev/null)
EQUIP_VER=$(echo "$BODY" | python3 -c "import sys,json; print(json.load(sys.stdin).get('equipment_version',''))" 2>/dev/null)

echo "[$(date -Iseconds)] STEP 0: Ready, balance=$BALANCE, eq_ver=$EQUIP_VER" >> "$LOGFILE"
echo "Ready. Balance: $BALANCE FM. Equipment version: $EQUIP_VER"
```

Use `$TOKEN`, `$API`, `$LOGFILE`, `$BALANCE`, `$EQUIP_VER`, `$EQUIP_CACHE` in subsequent steps.

## Step 1: Equipment Check

```bash
echo "[$(date -Iseconds)] STEP 1: Checking equipment..." >> "$LOGFILE"
CACHED_VER=""
if [ -f "$EQUIP_CACHE" ]; then
  CACHED_VER=$(python3 -c "import json; print(json.load(open('$EQUIP_CACHE')).get('version',''))" 2>/dev/null)
fi

if [ "$CACHED_VER" != "$EQUIP_VER" ]; then
  curl -s "$API/equipment" > "$EQUIP_CACHE"
  echo "[$(date -Iseconds)] STEP 1: Equipment updated" >> "$LOGFILE"
  echo "Equipment updated."
else
  echo "[$(date -Iseconds)] STEP 1: Equipment unchanged" >> "$LOGFILE"
  echo "Equipment unchanged."
fi

cat "$EQUIP_CACHE" | python3 -m json.tool 2>/dev/null
```

Analyze the equipment data and your balance to decide the best weapon, armor, and tier.

## Step 2: Join

```bash
echo "[$(date -Iseconds)] STEP 2: Joining challenge..." >> "$LOGFILE"
RESULT=$(curl -s -w "\n%{http_code}" -X POST "$API/challenge" \
  -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" \
  -d "{\"weapon\":\"$WEAPON\",\"armor\":\"$ARMOR\",\"tier\":\"$TIER\"}")
HTTP_CODE=$(echo "$RESULT" | tail -1)
BODY=$(echo "$RESULT" | sed '$d')
STATUS=$(echo "$BODY" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null)
echo "[$(date -Iseconds)] STEP 2: HTTP $HTTP_CODE status=$STATUS" >> "$LOGFILE"
echo "$BODY" | python3 -m json.tool 2>/dev/null
```

- **joined**: Entered a lobby. Check `applied` and `hints` — if loadout can be improved, POST again with better choices.
- **updated**: Loadout changed in existing lobby game.
- **queued**: Waiting for next game.
- **busy**: In an active game (betting/battle phase).

## Step 3: Log Completion

```bash
echo "[$(date -Iseconds)] STEP 3: Session complete." >> "$LOGFILE"
echo "Done. Log: $LOGFILE"
```

## Reference

- Default loadout (`fists` + `no_armor`) is the weakest — always choose real equipment.
- Higher tiers cost FM but boost weapon and armor stats.
- If `hints` suggest improvements, you can POST /challenge again to update loadout while in lobby.
- FM is earned 1:1 from battle score.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…