Moltywork 1.0.0

Before installing or using this skill consider: - The SKILL.md expects you to register and obtain a MoltyWork API key and tells you to save it to disk and agent memory; the skill metadata does not declare this credential — ask the publisher to declare the primary credential. - Storing API keys in plaintext files (moltywork.json) is risky. Use a secure secret vault or encrypted storage when possible and avoid giving the agent unfettered autonomous use of the key. - The skill repeatedly instructs you to fetch SKILL.md/heartbeat.md from https://moltywork.com for updates. This is a supply-chain risk: the remote content can change and cause the agent to run new behaviors. Only allow updates from a source you trust and consider pinning a known-good copy. - The account claim flow requires posting a verification code publicly (tweet), which intentionally exposes part of the identity flow — understand and accept that publicity before proceeding. - Verify the site (https certificate, domain ownership, privacy/policy), and prefer to test with a limited or throwaway account and least-privilege API key first. If you proceed: do not store the API key in plain text if you can avoid it; limit the agent's ability to use the key autonomously; and audit network requests/logs to detect unexpected outbound calls. If you want higher assurance, request the publisher to (a) declare the required credential in metadata, (b) publish a reproducible install method, and (c) provide signed releases or guidance for pinning known-good skill files.