Bundle Pluginsource linked

Game of Cardsv0.0.23

Game of Cards skills and hooks — agile work-card methodology for OpenClaw agents. Bundles the goc engine; requires only python3 (3.10+) on PATH.

game-of-cards·runtime game-of-cards·by @zauberzeug
openclaw bundles install clawhub:game-of-cards
Latest release: v0.0.23Download zip

Capabilities

Bundle format
generic
Runtime ID
game-of-cards

Compatibility

Built With Open Claw Version
2026.3.24-beta.2
Min Gateway Version
2026.3.24-beta.2
Plugin Api Range
>=2026.3.24-beta.2
Plugin Sdk Version
2026.3.24-beta.2
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The stated purpose, a Game of Cards task workflow for agents, matches the bundled skills, goc tool, and Python engine, but the capability set includes workspace mutation, git commits, lifecycle prompt injection, and local command execution.
!
Instruction Scope
Several artifacts explicitly tell the agent to run card operations silently and not announce them, and auto-invocation triggers include broad everyday phrases that could route ordinary requests into persistent workflow actions.
Install Mechanism
The package uses a normal OpenClaw plugin entry and discloses a goc tool plus lifecycle hooks; no destructive install script was found, but the plugin is non-official and starts automatically.
!
Credentials
Workspace-level deck files and git operations are expected for this workflow, but automatic prompt hooks, default auto-commit behavior for some card state changes, and repo-configured subprocess checks are high-impact and require careful scoping.
!
Persistence & Privilege
The skill persists task state under .game-of-cards, may update guidance files during setup, may create git commits, and can optionally push claim commits; this is disclosed in places but paired with hidden-operation instructions.
Scan Findings in Context
[AST4] expected: goc attest supports automated project checks by running commands from .game-of-cards/config.yaml. That fits closure verification, but makes repo-local config executable when a user runs attestation.
[SDI-4] unexpected: The source comment about avoiding a safe-install scanner token is not runtime malware, but it is poor security posture and supports Review because it describes accommodating scanner behavior.
[SQP-2] unexpected: The hidden card-operation instructions are artifact-backed: the plugin and deck skill tell the agent to file, claim, close, and commit without announcing bookkeeping to the user.
[SQP-1] unexpected: Broad auto-invoke descriptions are present across multiple skills, including create-card, deck, pull-card, finish-card, and decide-card; in this package those triggers can lead to persistent deck and git changes.
[SQP-3] unexpected: The source map mirrors the same hidden-operation instructions as the built plugin, confirming this is not just scanner noise.
What to consider before installing
Install only if you intentionally want an agent-managed task deck that can modify .game-of-cards files and sometimes commit workflow state. Review the auto-invoke behavior, disable or narrow silent workflows where possible, and treat .game-of-cards/config.yaml automated checks as executable code, especially in untrusted repositories.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Commit
62d8ea62f51e
Tag
refs/heads/main
Provenance
No
Scan status
suspicious

Tags

latest
0.0.23

Game of Cards — OpenClaw Plugin

Game of Cards (GoC) is an agile work-card methodology for AI-agent collaborators. This plugin delivers the full GoC skill, tool, and hook set to OpenClaw in a single install. The goc engine is bundled inside the npm payload — the only host prerequisite is python3 (3.10+).

Status: scaffolded against upstream OpenClaw plugin SDK v2026.3.x. The index.ts entry registers a goc tool + three lifecycle hooks. A few hook-context API shapes (ctx.projectDir, ctx.notify, ctx.appendSystemContext, ctx.toolCalls) are flagged as TODO(verify-context-shape) because they are not explicitly documented at https://docs.openclaw.ai/plugins/hooks.md; confirm against the actual SDK types during integration.

What's included

1 tool — registered programmatically, model-invokable:

ToolPurpose
gocFiles, advances, decides on, or closes cards in .game-of-cards/deck/. Wraps every goc CLI verb behind one typed function call: verb, args[], optional flags, optional cwd.

14 skills at workspace tier — model reads them as injected system context:

SkillPurpose
kickoffOnboarding dialog — introduces GoC, scaffolds .game-of-cards/
deckMethodology front door
scan-deckBrowse the board: triage view, filtered queues, decision Q&A
next-cardPick the highest-leverage open card to work on next
create-cardFile a new card with frontmatter + DoD scaffold
advance-cardFlip a card's status (open → active → blocked …)
finish-cardClose a card with DoD enforcement + commit
decide-cardRecord a decision and lower a human gate
pull-cardAutonomous round: claim → work → close → commit
refine-deckHygiene pass — retag stale, prune old parks
audit-deckHunt for one undocumented defect or gap
standupActive cards, blockers, closures since yesterday, decision gates
retrospectiveCluster closed cards by tag, surface recurring failure modes
card-schemaField reference — enums, canonical tags, DoD format

3 lifecycle hooks — fire automatically:

EventHookPurpose
session_startactive-card reminderPrints active cards at session boot; silent when none
before_prompt_builddeck-first reminderDetects work-initiating prompts; appends a deck-first reminder to system context
agent_endpattern-generalizationAfter code-mutating turns, prompts the model to consider filing a generalization card

Install

Once published to ClawHub:

openclaw skills install game-of-cards

The plugin is also published on npm as game-of-cards.

Prerequisite

python3 (3.10+) on PATH. The plugin invokes the bundled engine via python3 -m goc.cli from the tool handler — no uv, no pipx, no separate pipx install game-of-cards step.

Known limitations

Subagents do not see the goc tool (OpenClaw ≤ 2026.5.6)

Spawned subagents cannot call the goc tool even when explicitly listed in tools.subagents.tools.alsoAllow. The plugin loads, the runtime registry shows the tool (openclaw plugins inspect game-of-cards --runtime --json reports toolNames: ["goc"]), and main sessions can call goc — but spawned subagents report goc tool not available.

This is an upstream OpenClaw bug: the plugin tool allowlist for subagents reads policy.allow but does not include policy.alsoAllow. Tracked at:

Workaround: until OpenClaw includes the upstream fix, prefer documenting the limitation rather than restricting subagents' toolset. Setting tools.subagents.tools.allow: ["goc", ...] is a final allow-only filter that can accidentally remove standard subagent tools — only use it as a temporary workaround in narrow smoke environments where you control the full subagent toolset.

After OpenClaw releases the fix, subagents will see plugin tools through the documented alsoAllow path with no plugin-side change.

How GoC fits OpenClaw

OpenClaw's plugin architecture is a strong match for the deck pattern:

  • Tool registration is the OpenClaw-native way to expose a programmatic capability. The goc tool is a typed function ({ verb, args, flags, cwd }) that the model can call as it would any other tool — same surface as exec, browser, web_search.
  • Workspace-tier skills mean GoC activates automatically when the user's active workspace contains a deck, and silently otherwise.
  • Lifecycle hooks fire programmatically via api.on() — no hooks.json config to maintain, no shell-out to Python scripts, just TypeScript functions in the plugin entry.

Source of truth

This plugin is generated from the top-level goc/ package and the goc/templates/skills/ directory at the root of zauberzeug/game-of-cards. The bundled engine under openclaw-plugin/goc/ is byte-for-byte synced from goc/ by scripts/sync_plugin_assets.py (run by the project's pre-commit hook). The skills under openclaw-plugin/skills/ are hand-ported from goc/templates/skills/ with invocation-neutral edits — they read sensibly under both registered-tool (OpenClaw) and Bash + PATH (Claude Code) primitives.

To contribute, edit the source-of-truth files:

SourceMirrors to
goc/ (Python engine)openclaw-plugin/goc/ (auto-synced)
goc/templates/skills/<name>/SKILL.mdopenclaw-plugin/skills/<name>/SKILL.md (hand-ported)
goc/templates/hooks/*.pyopenclaw-plugin/index.ts (TypeScript ports)

License

MIT — see the repository root for the full text.