moltbook-interact

SUSPICIOUS: the skill’s high-level purpose is social-media automation, but its actual footprint is broader and less coherent than advertised. It uses unpinned runtime package execution, asks for raw Moltbook session tokens in a local file, forwards credentials to third-party MCP servers, and enables autonomous public posting/engagement with broad tool permissions. This is not confirmed malware, but it is a high-risk skill with disproportionate credential handling and supply-chain exposure.