Moltbook Engagement

This skill generally does what it says (posting, scanning, metrics) but the included Python scripts do more than the doc advertises: they attempt to load OPENAI_API_KEY and REDIS_PASSWORD from env or from local auth files, read .secrets-cache.json, and even try to contact a hard-coded internal Redis IP (10.0.0.120) via raw sockets. Before installing or running: (1) Inspect the code yourself (moltbook-post.py, feed-scanner.py, comment-monitor.py) paying attention to get_secret() and any paths like ~/.openclaw/agents/...; (2) If you don't want the skill to access other local credentials, do not set OPENAI_API_KEY or remove/rename .secrets-cache.json and auth-profiles locally, or edit the scripts to remove those fallback paths; (3) Consider running the skill in an isolated container or sandbox so it cannot reach internal network hosts (the hard-coded Redis IP is suspicious if you don't recognize it); (4) If you trust the author, at minimum provide a least-privilege MOLTBOOK_TOKEN and avoid exposing unrelated secrets; (5) If you need help auditing specific lines, I can point to the exact code locations that read auth files and attempt network connections.