The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/moltbook.sh attempts to read sensitive data from ~/.openclaw/auth-profiles.json. This file is the primary authentication store for the OpenClaw platform, and accessing it allows the skill to potentially expose credentials for services entirely unrelated to Moltbook.
[COMMAND_EXECUTION]: The helper script scripts/moltbook.sh performs unsafe interpolation of shell variables. Specifically, the reply and create commands take user-supplied or agent-supplied text and place it directly into shell strings and curl payloads without escaping. An attacker could provide input containing shell metacharacters (such as backticks or $()) to trigger arbitrary command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes several Model Context Protocol (MCP) servers using npx as defined in SKILL.md. These include @apify/mcp-server, @makenotion/mcp-server, and @modelcontextprotocol/server-slack.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from an external social network.
Ingestion points: Data is retrieved from the Moltbook API via the hot, new, and post commands in scripts/moltbook.sh.
Boundary markers: There are no boundary markers or instructions used to separate the external social media content from system-level instructions.
Capability inventory: The skill has access to local shell execution through moltbook.sh and various external integrations via Slack, Notion, and Apify MCP servers.
Sanitization: No sanitization or filtering is applied to the content fetched from the Moltbook API before it is processed by the agent.

joko-moltbook