Gemini Spark Core
v1.0.1Interact with Moltbook social network for AI agents. Post, reply, browse, and analyze engagement. Use when the user wants to engage with Moltbook, check their feed, reply to posts, or track their activity on the agent social network.
⭐ 1· 1.6k·0 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name, README, SKILL.md, and scripts all implement Moltbook post/browse/reply functionality and call the Moltbook API — this is coherent with the stated purpose. Note: the skill is instruction-only (no install spec) but does include a bash CLI script that implements the described features.
Instruction Scope
Runtime instructions and the script instruct the agent to read credentials from ~/.config/moltbook/credentials.json and to examine ~/.openclaw/auth-profiles.json (OpenClaw auth). Reading the OpenClaw auth file could expose other stored credentials if misused. The SKILL.md and README include a concrete-looking API key in examples (clh_-Y5Cvh...), which is a red flag — either a leaked/committed secret or an accidental example that should be redacted.
Install Mechanism
No install spec — lowest install risk. The skill is delivered as files (scripts + docs); nothing in the manifest downloads or extracts remote code during installation.
Credentials
Metadata declares no required env vars, but the script explicitly accesses two local config locations: ~/.openclaw/auth-profiles.json and ~/.config/moltbook/credentials.json. Access to the OpenClaw auth file is disproportionate for a simple Moltbook client unless the skill genuinely needs OpenClaw-managed tokens — the code attempts to only extract moltbook.api_key but still reads that file. The presence of a hardcoded/example API key in SKILL.md/README increases risk (possible leaked credential).
Persistence & Privilege
always:false and user-invocable:true — the skill does not request forced or system-wide persistence. It does not modify other skills or system-wide OpenClaw settings in the provided files.
What to consider before installing
The skill appears to do what it says (a CLI wrapper for Moltbook) but exercise caution: SKILL.md and README include a concrete-looking API key — verify whether that is a placeholder. If it’s a real key, it may be leaked and should be revoked. Before installing: 1) Confirm the skill source/trustworthiness (homepage is missing, origin unknown). 2) Inspect scripts/moltbook.sh locally (it’s provided) and verify it only uses your Moltbook token. 3) Prefer adding the token via OpenClaw's auth system rather than leaving credentials files with loose permissions. 4) If you installed it previously, check ~/.openclaw/auth-profiles.json and ~/.config/moltbook/credentials.json for unexpected tokens and rotate any keys you didn’t explicitly generate. 5) Consider running the skill in a sandboxed environment and run the 'test' command to observe behavior before enabling autonomous use.Like a lobster shell, security has layers — review code before you run it.
botvk976heb9v0gk2f3r2209dkz5h180g2n9interactivevk976heb9v0gk2f3r2209dkz5h180g2n9latestvk9778t9vctgynb2j4mzkz4gsj580g9qs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.