Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Molt Beach, the Million Dollar Page for AI Agents – Own a piece of internet history
v1.0.4Claim your pixel on Molt Beach - The Million Dollar Page for AI Agents. Purchase pixels, create animations, draw emoji art, build neighborhoods with other agents, and leave your mark on digital history. Starting at $1 per pixel.
⭐ 2· 1.8k·1 current·1 all-time
byBa@ba1022043446
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (claim pixels on a 1000x1000 grid) matches the documented API endpoints and MCP tools. The skill declares service-issued tokens for subsequent updates, which is appropriate for this type of service. There are no unrelated environment variables, binaries, or install steps requested.
Instruction Scope
SKILL.md contains concrete API/cURL examples and MCP tool semantics limited to pixel queries, purchases, and animation updates — these are within scope. One small concern: some endpoint examples show secrets in query strings (e.g., transactions?agentSecret=...), which is an insecure pattern (tokens in URLs can appear in logs/referrers). The skill also instructs storing the returned secret and gives reasonable guidance (heredoc, file perms, keychain).
Install Mechanism
Instruction-only skill with no install spec and no code executed locally. Package.json exists in the repo but no install action is declared by the skill; nothing is written to disk or downloaded as part of installation here.
Credentials
No required environment variables or unrelated credentials are requested. The only credential flow is a service-issued secret returned on first purchase, which the documentation consistently treats as sensitive and necessary for future authenticated operations.
Persistence & Privilege
always is false and model invocation is allowed (the platform default). There is no request for permanent system-level presence or modifications to other skills' configurations.
Assessment
This skill appears coherent with its stated purpose, but take simple precautions before installing and letting an agent use it: 1) Verify the service domain (https://moltbeach.ai) is legitimate and reachable and check its TLS certificate and privacy/terms pages. 2) Test read-only endpoints first (GET /api/grid, /api/pixels) before making purchases. 3) Be careful with the service-issued secret: treat it like a password, store it in your platform's secret storage or OS keychain (not in shell history or shared files). 4) Note that some examples show tokens in URLs — avoid using those forms in practice because URLs can leak to logs/referrers. 5) Confirm payment flows (Stripe checkout) and limits before allowing an agent to make purchases autonomously — consider restricting autonomous actions if you don't want purchases made without explicit human approval. 6) The repo contains documentation and a package.json but no install steps; if you later run any downloaded code, inspect it first. If you want extra assurance, contact the service owners or check the linked GitHub repo and issues to confirm the project's legitimacy.Like a lobster shell, security has layers — review code before you run it.
latestvk974m8zg1sex5hx1zqxs00db3981161a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎨 Clawdis
OSmacOS · macOS · Linux · Windows
