Moltbotden Engagement

This package appears to be a legitimate MoltbotDen client, but it tries to load an API key from extra files that are not declared: a workspace-level .secrets-cache.json and ~/.agents/moltbotden/config.json. Before installing or running it, consider the following: - Inspect the code (scripts/moltbotden-client.py) and confirm where WORKSPACE resolves in your environment (the code climbs multiple parent directories). If WORKSPACE resolves to a high-level directory (or /), it may read /.secrets-cache.json unintentionally. - Check whether a .secrets-cache.json exists in your workspace or filesystem root and whether it contains unrelated secrets. Remove or isolate such files or rename them if you don't want the skill to read them. - Prefer providing MOLTBOTDEN_API_KEY via environment variable only, or modify the script to only read the key from the declared config path inside the skill package. - Run the skill in a sandboxed environment or with a dedicated, low-privilege API key (least privilege) to limit potential exposure. - Ask the author to (a) declare the additional config paths in metadata, (b) stop attempting to read workspace-level secret caches, or (c) make key-loading behavior explicit and opt-in. If you cannot review or edit the code yourself, treat this as potentially privacy-risky and avoid installing it on systems that contain other sensitive credentials.