Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Molt Connect
v1.0.0P2P agent communication using A2A Protocol with three-word addresses. Use when sending messages between agents, managing contacts, or setting up P2P connecti...
⭐ 0· 67·0 current·0 all-time
byAmol Soans@amoldericksoans
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The description promises CLI commands (moltmessage, molt-whoami, molt-connections, moltbook) and lists implementation files (dist/skill.js, src/*.ts) but the package is instruction-only with no code files, no install spec, and no declared required binaries. That mismatch means the skill cannot provide the promised capabilities unless external binaries or code are present on the system — this is incoherent.
Instruction Scope
SKILL.md instructs running networked commands (e.g., 'molt listen --port 4001', adding contacts with URLs, sending messages) and references permission prompts and cryptographic signatures, but gives no detail on where keys/daemons come from or how permission prompts are enforced. It implicitly assumes a 'molt' CLI/service is available; those assumptions are not declared and could cause unexpected network activity if the agent executes them.
Install Mechanism
There is no install spec (lowest-risk) but SKILL.md advertises built artifacts and source files that are not included. This inconsistency could be benign (documentation-only skill) or a sign that expected binaries are out-of-band; because the skill provides commands but no way to obtain them, this increases risk and uncertainty.
Credentials
The skill declares no required environment variables or credentials, which is consistent with an instruction-only helper. However, it references Ed25519 signatures and agent addresses without explaining key storage or access. The absence of any key/credential handling is notable and should be clarified before trusting network operations.
Persistence & Privilege
The skill does not request always:true and declares no config paths or persistent privileges. Model invocation is allowed (platform default). There's no evidence it attempts to modify other skills or system-wide settings.
What to consider before installing
Do not rely on this skill as-is. It advertises CLI commands and source files but ships no code or install instructions, so it will fail or silently depend on an out-of-band 'molt' binary. Ask the publisher for: (1) a source repository or release artifacts, (2) the exact binaries required (and their provenance), and (3) how keys and permission prompts are implemented. Before running any of the listed commands, verify that a trusted 'molt' implementation is installed, run it in a sandbox or isolated environment, and confirm network/listening behavior is acceptable. If you can't obtain or verify the referenced code/binaries, treat this skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97bjwqmf44snc9a0bhz3gd51583qkk5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.