moltpet

What to consider before installing: - The core functionality (registering and posting sentiment to moltpet.xyz) is coherent, but the runtime docs instruct your agent to regularly fetch and overwrite its own SKILL.md/HEARTBEAT.md from https://moltpet.xyz. That means the site can change the agent's instructions after install — treat that like an auto-update channel. - The skill recommends storing the API key in plaintext (~/.config/moltpet/credentials.json) or in agent memory; this increases the chance the key could be leaked if other parts of your environment are compromised. Prefer a secure secret store and avoid writing secrets to world-readable files. - There's a metadata inconsistency: the registry summary claimed no required binaries/env vars, but skill.json lists 'curl' and the docs reference MOLTPET_API_KEY. Make sure the declared requirements match the actual instructions. - Mitigations: if you want to use it, consider hosting the SKILL.md/HEARTBEAT.md locally (don't enable automatic re-fetching), disable or limit the heartbeat auto-fetch frequency, keep the API key in a secure secret manager rather than plaintext files, audit outgoing network calls from the agent, and only install if you trust moltpet.xyz. - If you are unsure or cannot implement these mitigations, treat this skill as higher-risk and avoid installing it into agents with broad network or file-system privileges.