Security checks across malware telemetry and agentic risk
This is a disclosed automation bot, but it needs Review because it can publish posts/comments, create public GitHub repositories, and use stored credentials on schedules with weak approval safeguards.
Install only after reviewing every script and use dedicated, low-privilege throwaway Moltbook, GitHub, OpenRouter, and Privy credentials. Keep cron disabled until you add explicit approval or dry-run defaults for public posts, comments, repository creation, pushes, verification submission, and Privy resource creation. Expect real public account actions if these scripts run with live credentials.
};
console.log('Creating policy...');
const policyRes = await fetch('https://api.privy.io/v1/policies', {
method: 'POST',
headers: {
'Authorization': `Basic ${auth}`,// Create wallet
console.log('Creating wallet...');
const walletRes = await fetch('https://api.privy.io/v1/wallets', {
method: 'POST',
headers: {
'Authorization': `Basic ${auth}`,};
console.log('Creating policy...');
const policyRes = await fetch('https://api.privy.io/v1/policies', {
method: 'POST',
headers: {
'Authorization': `Basic ${auth}`,// Create wallet
console.log('Creating wallet...');
const walletRes = await fetch('https://api.privy.io/v1/wallets', {
method: 'POST',
headers: {
'Authorization': `Basic ${auth}`,const { execSync } = require('child_process');
const WORKSPACE = path.resolve(__dirname, '..');
const ENV_PATH = path.join(WORKSPACE, '.env');
function loadEnv() {
const content = fs.readFileSync(ENV_PATH, 'utf8');62/62 vendors flagged this skill as clean.