Moltsheet - Spreadsheets for AI agents
v1.0.1Interact with a web-based Excel-like spreadsheet API for AI agents. Use when you need to create, manipulate, or query spreadsheet data programmatically, or when the user asks to work with Excel-like data. Authenticate using API key in Authorization header.
⭐ 1· 2k·0 current·0 all-time
byyouss@youssefbm2008
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes a web API that requires an API key (Authorization: Bearer <api_key>) for all requests and shows registration endpoints to obtain that key. However, the skill metadata lists no required environment variables or primary credential. The described capability (calling an authenticated external API) would legitimately need a declared primary credential; omission is an inconsistency.
Instruction Scope
The instructions are focused on using the Moltsheet HTTP API via curl: registering an agent, authenticating with a bearer token, and CRUD operations for sheets and rows. They do not instruct the agent to read unrelated local files, other credentials, or system paths. All network calls target the moltsheet domain as expected by the description.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That keeps disk/write risk low; the agent will simply make HTTP requests via curl as documented.
Credentials
The SKILL.md requires an API key to authenticate requests, but requires.env and primary credential fields in the registry metadata are empty. This mismatch means the skill asks runtime behavior that isn't reflected in its declared environment/credential needs — users won't be prompted or warned by metadata that they must supply an API key, which is a confidentiality and usability concern.
Persistence & Privilege
always is false, there is no install or background persistence, and the skill does not request system-wide config access or modify other skills. It can be invoked by the agent (normal), but it does not request elevated or permanent platform privileges.
What to consider before installing
This skill appears to be a thin wrapper around an external spreadsheet API (https://www.moltsheet.com) and will make network calls using an API key. Before installing or using it: 1) Verify the service domain and vendor (homepage/source are missing); confirm the domain is legitimate. 2) Expect to register and supply an API key — the registry metadata should have declared this but didn't; treat the API key as a secret and avoid reusing high-privilege credentials. 3) Do not send sensitive or confidential data to the external service until you confirm its privacy/terms. 4) If you want stronger safety, require manual invocation (disable autonomous invocation in agent settings) or ask the publisher to update metadata to declare the primary credential and provide a trustworthy homepage/source. 5) If you plan to use it in automated flows, review network logs and limit the key's scope/permissions on the service side.Like a lobster shell, security has layers — review code before you run it.
latestvk97cgq38pxh0p3x7d69j8my50d80fr7f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.