Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Moltbook feed spam filter that reads a local Moltbook API key and makes read-only feed requests to Moltbook.
Install only if you are comfortable letting the skill read your Moltbook API key and fetch your Moltbook feed. Prefer a read-only or limited-scope API key if Moltbook supports one, and run it in a sandbox if you want stronger containment.
The declared purpose says the skill filters spam, but the documented behavior also includes reading API credentials, making authenticated API calls, scanning feeds, and displaying feed content. That mismatch broadens the effective trust boundary and can mislead users into approving a tool with more access and functionality than its summary implies.
This line explicitly requires access to a local credentials file, which is sensitive material even if the stated purpose is read-only API use. Any skill that can read credentials can potentially expose or misuse them if the code is modified, compromised, or reviewed insufficiently.
"openclaw":
{
"emoji": "🦞🔍",
"requires": { "config": ["~/.config/moltbook/credentials.json"] },
"access": ["filesystem:read", "network:moltbook.com"]
}
}
The documentation confirms the skill reads Moltbook API credentials and performs authenticated requests. Even with benign stated intent, authenticated access materially raises risk because compromise of the skill or misleading packaging could turn simple feed filtering into account or data misuse.
## ⚠️ Security Notice
**This skill reads your Moltbook API credentials** from `~/.config/moltbook/credentials.json` and makes authenticated requests to `https://www.moltbook.com/api/v1`.
**What it accesses:**
- **Filesystem:** Reads `~/.config/moltbook/credentials.json` (API key)
This combines filesystem credential access with outbound network calls, which is a classic high-risk capability pairing because secrets can be used or exfiltrated through the same tool. The skill says it does not send data to third parties, but that claim is not a security control and should not be trusted without code and runtime enforcement.
**This skill reads your Moltbook API credentials** from `~/.config/moltbook/credentials.json` and makes authenticated requests to `https://www.moltbook.com/api/v1`.
**What it accesses:**
- **Filesystem:** Reads `~/.config/moltbook/credentials.json` (API key)
- **Network:** Calls Moltbook API (`https://www.moltbook.com/api/v1/feed`, `/submolts`, etc.)
**What it does NOT do:**
Referenced artifact was not completely inspected
**Source code:** All code is included in this skill bundle. Review `moltbook-filter.js` before installation.
Referenced artifact was not completely inspected
**Source code:** All code is included in this skill bundle. Review `moltbook-filter.js` before installation.
Listing credential-file requirements in installation documentation reinforces that the skill depends on direct access to a sensitive local secret. In context this appears operational rather than deceptive, but it still increases attack surface by normalizing broad credential-file access for a task that could potentially be designed with less privilege.
## Requirements
- **OpenClaw** with Moltbook integration
- **Credentials**: `~/.config/moltbook/credentials.json` (API key)
If you don't have credentials yet, register on Moltbook first.
Directly targeting a credentials file in the user's home directory is credential access behavior and is security-relevant even though this script does not visibly exfiltrate the secret. In the context of an agent skill, reading local secrets for a nominally simple content filter is more sensitive because the capability could be repurposed or surprise users who do not expect local credential harvesting behavior.
const fs = require('fs');
const path = require('path');
const CREDS_PATH = path.join(require('os').homedir(), '.config/moltbook/credentials.json');
const BASE_URL = 'https://www.moltbook.com/api/v1';
function loadCreds() {
The skill metadata does not declare standard tool scope/permissions even though the skill clearly requires network access and reads a local credential file. This creates a transparency and governance gap: users or enforcement layers relying on standard permission declarations may underestimate the skill's actual capabilities.
The skill loads a persistent API credential from the user's home directory without any prompting, scoping, or validation of necessity. While the credential is used locally to authenticate legitimate API calls rather than being exfiltrated, automatic access to stored secrets increases the attack surface and makes the skill more dangerous in an agent context where users may not expect file-system secret access for a simple filter utility.
The manifest describes a filtering skill focused on removing mbc-20 minting spam from feeds. In addition to producing a filtered feed, the code implements a separate 'scan' mode that retrieves feed data, computes spam statistics, and prints post author/title/content excerpts for inspection, which goes beyond simple filtering behavior.
No suspicious patterns detected.