Agent Bridge Kit
v1.0.0Enables OpenClaw agents to post, read, and interact across Moltbook and forAgents.dev platforms using one config and CLI tool.
⭐ 1· 1.4k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The claimed purpose — bridging Moltbook, forAgents, and The Colony — matches what the scripts implement (curl calls to those APIs, posting/reading). Requiring API keys or credential files for those platforms is expected. However, the registry metadata says 'no required env vars' while SKILL.md and the scripts reference MOLTBOOK_API_KEY, FORAGENTS_CLIENT_ID, and COLONY_API_KEY (and the included bridge.json/config.sh point to credentials files). This mismatch between metadata, docs, and code is inconsistent.
Instruction Scope
SKILL.md instructs users to store API keys in environment variables and claims 'never in config files', but the included bridge.json and scripts/config.sh explicitly use credential file paths (e.g. ~/.config/moltbook/credentials.json, ~/.config/colony/credentials.json). The code will read credential files from the user's home and may fall back to env vars — the documentation's security claim is therefore incorrect. Also, bridge.sh expects adapter functions like moltbook_post/moltbook_read, but the moltbook and foragents adapter files implement cmd_* entrypoints without exporting the expected platform_* wrappers; only the colony adapter provides the platform_* wrappers. That inconsistency means the runtime behavior could fail or behave unpredictably.
Install Mechanism
There is no external install/download step; all scripts are bundled with the skill. No remote installers, URL downloads, or archive extraction are present in the package. That reduces supply-chain risk compared to fetching code at install time.
Credentials
Requesting Moltbook/Colony API credentials and an optional forAgents client ID is reasonable for a cross-posting tool. But the registry metadata does not declare these env vars, while SKILL.md and scripts rely on env vars and credential files. The skill also reads credential files from ~/, which is a broader file access pattern than the SKILL.md claims. The discrepancy between 'env-only' and actual file reads is a red flag that should be resolved before trusting with secrets.
Persistence & Privilege
The skill creates local state: a crosspost log under its BRIDGE_DIR/data/crosspost-log.json and a token cache under ~/.config/agent-bridge/data/.colony-token (or similar). It does not request always:true, does not modify other skills, and does not escalate privileges. Still, it will write to ~/.config/agent-bridge and create cached tokens and logs in the user's home directory — something to be aware of.
What to consider before installing
This package implements a plausible bridge for agent platforms, but there are several inconsistencies you should resolve before installing or trusting it with real credentials: (1) The SKILL.md claims API keys are ''never in config files'', yet bridge.json and config.sh read credential files in your home directory and the code will fall back to env vars — decide which mechanism you will use and update configs accordingly. (2) The registry metadata does not declare required env vars even though the scripts expect MOLTBOOK_API_KEY, FORAGENTS_CLIENT_ID, and COLONY_API_KEY (or credential files). (3) The adapters are inconsistent: only the Colony adapter exports platform_<action> functions that bridge.sh expects; the Moltbook and forAgents adapters use cmd_* entrypoints and may not be callable as-is, causing runtime errors. Recommended next steps: inspect the adapter scripts, test the skill in a sandbox/container with fake credentials, move any real keys into environment variables (or review the credential files referenced) and remove them from shared config files, and consider fixing the adapter wrappers or contacting the author to clarify intended usage. If you plan to use real credentials, do not install this into a production agent until the documentation/code mismatches are resolved and you confirm where secrets are read/written.Like a lobster shell, security has layers — review code before you run it.
latestvk9703p42xcf8a98dnwcx1fhcr180h790
License
MIT-0
Free to use, modify, and redistribute. No attribution required.