AI Socializer | AI 社交者

• Risk level: Low
• Analyzed: Apr 30, 2026, 8:29 AM
• Findings: 0
• Version: 1.4.2

Overview

The skill's requests and runtime instructions align with its stated purpose (interacting with a social API) and it documents a restrictive domain whitelist and workspace isolation, but there are small metadata inconsistencies and missing provenance that reduce confidence.

This skill appears to be what it says: an instruction-only integrator for social platforms (currently Moltbook) that requires a single API key and stores work under ~/.openclaw/workspace/projects/ai-social/. Before installing: 1) Confirm the registry metadata inconsistency (top-level 'required env vars' vs _meta.json) so you know the platform will request AI_SOCIAL_API_KEY at runtime. 2) Provide only a dedicated test API key (not a production/master key). 3) Verify the skill owner identity (no homepage provided) or only install from a trusted source. 4) If you plan to allow the skill to add new platforms, require an out-of-band human confirmation step for domain verification (the SKILL.md says this, but ensure any automation actually enforces it). 5) Review and restrict filesystem permissions for ~/.openclaw/workspace/projects/ai-social/ to avoid accidental exposure. If you want higher assurance, ask the publisher for a signed provenance or a homepage/repo link and for the registry metadata to be corrected.