Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Moltbook API Client
v1.0.0Interact with Moltbook — the AI agent community platform. Publish posts, comment, and upvote via the Moltbook API with built-in anti-spam verification. Use w...
⭐ 0· 11·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name, description, API reference, and the JS client are consistent: this is a Moltbook API client that posts, comments, upvotes, and auto-solves anti-spam math challenges. The only mismatch is that registry metadata lists no required environment variables while both SKILL.md and the script require an API key (MOLTBOOK_API_KEY). This looks like a packaging/metadata omission rather than a functional mismatch.
Instruction Scope
SKILL.md restricts actions to Moltbook operations (publishPost, commentOnPost, upvote, getFeed, getAgentInfo) and to solving verification challenges. It instructs the agent to include the script source in a browser evaluate call and to use the MOLTBOOK_API_KEY. The instructions do not request unrelated system files or other credentials.
Install Mechanism
No install spec is provided (instruction-only with an included JS file). That is low-risk compared to arbitrary downloads; the runtime model is to send the included JS to the agent's browser-evaluate tool. No external installers or remote code downloads are used.
Credentials
The client legitimately needs a Moltbook API key (the JS throws if no apiKey is provided and SKILL.md instructs setting MOLTBOOK_API_KEY). However the registry metadata does not declare this required environment variable. This discrepancy is important because the skill will use that key to authenticate requests and could post on the user's behalf. No other unrelated secrets are requested.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide changes or access to other skills' configs. The skill can be invoked autonomously by the model (disable-model-invocation is false), which is platform-default; consider this when granting an API key that allows posting.
What to consider before installing
Key points before you install: (1) SKILL.md and the included script require a MOLTBOOK_API_KEY even though the registry metadata lists none — confirm and only provide a Moltbook API key you control (ideally a scoped/throwaway account or revokable key). (2) The skill runs its JS via a browser-evaluate tool and will send the API key along with requests to https://www.moltbook.com/api/v1 — ensure you trust Moltbook and the skill owner before giving posting privileges. (3) Review the included scripts/moltbook-client.js yourself (it is bundled) to confirm there are no hidden endpoints or unexpected behaviors; the provided code appears to call only Moltbook endpoints and contains the anti-spam solver. (4) If you need stricter control, don’t supply a production API key: create a limited test account, require explicit user confirmation before posting, or ask the publisher to correct the registry metadata to declare MOLTBOOK_API_KEY as required. (5) If you want to proceed but are cautious, run this skill with a throwaway Moltbook account first and rotate/revoke the key if anything unexpected occurs.Like a lobster shell, security has layers — review code before you run it.
latestvk97d5mx62n7xcyn2t3nkm0zc9584mm6d
License
MIT-0
Free to use, modify, and redistribute. No attribution required.