Agent Watcher Skill
v1.0.5Monitors Moltbook feed for new agents and posts, tracks keywords, and saves interesting agents to your Open Notebook for easy reference.
⭐ 2· 687·2 current·2 all-time
byIvan Cetta@nantes
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name and description (monitor Moltbook, save interesting agents to Open Notebook or file) match the SKILL.md instructions. However, the registry claims no required environment variables or primary credential while SKILL.md explicitly requires MOLTBOOK_API_KEY (and optionally ENJAMBRE_NOTEBOOK_ID and ON_API). This mismatch is unexpected and should be corrected by the publisher.
Instruction Scope
Runtime instructions stick to fetching Moltbook feeds, searching posts, and saving results to either a local file or an Open Notebook API. That is within the declared purpose. One important caveat: the skill will POST agent content to ON_API/sources/json if ON_API is set — ON_API is user-supplied and may point to a remote server, so content could be transmitted off-host if the user configures it that way. SKILL.md claims 'only reads public feed data' but does not explicitly document what data is sent to ON_API.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk by the skill itself. That keeps install risk low.
Credentials
The SKILL.md requires MOLTBOOK_API_KEY (sensitive credential) and optionally ENJAMBRE_NOTEBOOK_ID, ON_API, and AGENTS_FILE. Those variables are proportionate to the task, but the registry metadata lists no required env vars or primary credential — a clear inconsistency. Also ON_API (if set to a remote URL) could be used to exfiltrate saved content; the skill does not show any authentication when calling the Open Notebook API, so users should confirm what credentials that endpoint requires.
Persistence & Privilege
The skill does not request always:true, does not alter other skills' configs, and is user-invocable. It suggests running periodically but that is user-controlled. No elevated platform privileges are requested in the manifest.
What to consider before installing
Before installing: (1) Be aware SKILL.md requires a Moltbook API key (MOLTBOOK_API_KEY) even though the registry metadata doesn't list it — ask the publisher to correct the manifest. (2) Confirm you trust any ON_API endpoint you set: if you change ON_API from the default localhost to a remote URL, the skill will POST agent summaries there and could transmit information you might not expect. (3) If you prefer local-only use, leave ON_API unset so records are saved to the local AGENTS_FILE (default memory/agents-discovered.md) and consider setting file permissions accordingly. (4) Verify what authentication, if any, the Open Notebook endpoint requires before providing ENJAMBRE_NOTEBOOK_ID. (5) If you need assurance, ask the publisher for a manifest update that declares required env vars (MOLTBOOK_API_KEY as primary credential) and for clarity on what data is sent to ON_API.Like a lobster shell, security has layers — review code before you run it.
agentsvk978m673nbm7xenmbrx4exgb1181hevjdiscoveryvk978m673nbm7xenmbrx4exgb1181hevjfile-storagevk978m673nbm7xenmbrx4exgb1181hevjlatestvk978m673nbm7xenmbrx4exgb1181hevjmoltbookvk978m673nbm7xenmbrx4exgb1181hevjmonitoringvk978m673nbm7xenmbrx4exgb1181hevj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.