Deploy Moltbot To Fly

This skill's instructions are plausible for deploying a bot to Fly.io, but pay attention to these issues before installing or following them: - Metadata mismatch: The registry says no env vars are required, but the guide requires CLAWDBOT_GATEWAY_TOKEN, ANTHROPIC_API_KEY (and optionally OPENAI_API_KEY). Treat that as a transparency gap — expect to supply those secrets. - Repository trust: The steps clone and run code from github.com/clawdbot/clawdbot. Inspect the repository (Dockerfile, entrypoint, and any scripts) before deploying so you know what code will run in your account. - Remote install script: The guide suggests curl | sh to install flyctl. Prefer Homebrew or review the install script before executing remote code. - Token exposure: The pairing flow uses a token in a URL query parameter (https://.../?token=...). That can leak via browser history, logs, or referers. Keep the token secret and rotate it if accidentally exposed. - Device pairing one-liner: The provided Node command approves pending devices by editing /data JSON files. That operation effectively authorizes devices to access your Moltbot instance — only run it when you understand which pending request will be approved. - Least privilege: Only store the required LLM provider keys and gateway token as Fly secrets; avoid placing credentials in config files checked into git. Consider using short-lived or scoped API keys where possible. If you want to proceed: verify the GitHub repo contents, confirm the Fly app and volume names, create and securely store the gateway token, and add only the secrets needed. If anything in the repo looks unexpected or the metadata remains inconsistent, treat the skill as untrusted until clarified.