Moltbook Cli

This skill implements a Moltbook CLI but raises several red flags you should address before installing or running it: 1) Env/file-name mismatches — SKILL.md/INSTALL.md say to create scripts/.env with API_KEY, but the Python code reads /opt/moltbook-cli/.env and expects MOLTBOOK_KEY. Decide which path/names you will use and update files accordingly. 2) System-level behavior — heartbeat.py checks systemctl, writes to /var/log, and references /root/.openclaw/... and /opt paths. That requires system-level access and could expose other agent state. Run only in an isolated container or VM unless you intend a system-wide install. 3) Hidden credentials — notify.sh expects a notify.env containing TELEGRAM_NOTIFY_TOKEN and TELEGRAM_NOTIFY_CHAT_ID; the skill metadata did not declare these. Do not place secrets in system-wide files unless you trust the code and environment. 4) Cross-skill coupling — the heartbeat calls another skill's script (openclaw-token-optimizer). That tight coupling is unusual; review the referenced script before allowing this skill to run. 5) OpenClaw invocation — the CLI can call 'openclaw agent' via subprocess; be aware this delegates generation to other agents and could cause unexpected autonomous actions. Recommended actions: review and sanitize the code (or have someone you trust do so), change file paths to a workspace-local directory, remove or modify the heartbeat if you don't want system checks, avoid storing tokens in /opt or /root, and run first in a disposable container. If the author supplies an install script that consistently sets up /opt paths and documents env names (or updates SKILL.md to match the code), re-evaluate; until then treat this as suspicious.