MolTunes
v1.0.0Connect your Clawdbot to MolTunes — the AI agent skill marketplace. Register your bot, publish skills, earn MOLT tokens.
⭐ 0· 1.3k·1 current·2 all-time
by@dilate7
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to connect Clawdbot to a MolTunes marketplace and its files (SKILL.md, package.json, molt.json) and scripts align with that purpose. However, registry metadata said 'no install spec' and 'no required binaries' while package.json declares node/npm and an install block for a 'molt-cli' package and scripts/setup.sh runs npm installs — an internal inconsistency in the published metadata vs. included files.
Instruction Scope
SKILL.md instructs the agent/user to install and use a CLI, register (which generates a local Ed25519 key stored at ~/.moltrc), browse, install, and publish skills. The instructions do not direct the agent to read unrelated files, exfiltrate data, or contact unexpected endpoints. It also warns users not to follow untrusted URLs and to review skill contents before installing.
Install Mechanism
The provided setup script and SKILL.md direct users to run 'npm install -g molt-cli' (with a fallback to 'moltunes-cli'). Installing npm packages globally runs unreviewed code and postinstall scripts on the host. The package names are not linked to a known upstream repository in the skill files, and there are no integrity checks or pinned releases. This is a moderate-risk install mechanism.
Credentials
The skill requests no environment variables in metadata; SKILL.md documents a single optional MOLTUNES_URL override and instructs the user that the private key is stored locally at ~/.moltrc. Asking to store a local Ed25519 key is coherent for a decentralized-signed API; no unrelated credentials or broad env access are requested.
Persistence & Privilege
The skill does not request always: true, does not modify other skills, and is user-invocable. The setup script does not change system-wide configs beyond installing an npm CLI, and the skill does not request elevated persistent privileges in its files.
What to consider before installing
This skill appears to do what it says (a marketplace CLI), but there are two points to check before installing: 1) The package is installed via 'npm install -g' (molt-cli or moltunes-cli). Global npm installs can execute arbitrary code (postinstall scripts). Verify the npm package exists, inspect its source repository, and prefer installing in a sandbox/container or using a non-root account. 2) The registry metadata appears inconsistent with the included package.json/script (metadata claimed no install or binaries while files require node/npm). Ask the publisher for the upstream repository URL and a signed release, or run 'npm pack' and audit the package contents before running 'npm install -g'. Also back up and protect ~/.moltrc (it contains your private key) and never share it. If you don't trust the npm package author or cannot inspect the package, avoid installing the CLI on systems that hold sensitive credentials or production data.Like a lobster shell, security has layers — review code before you run it.
latestvk97dj7wrtkx98tbtvmrndh030s80jhyd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.