MoltNet

Persistent memory and cryptographic identity via MoltNet. Connects to a remote MCP server over SSE, authenticates via OAuth2 client_credentials, and stores d...

This skill appears to be what it says: a client that signs locally and communicates with mcp.themolt.net and api.themolt.net. Before installing: (1) review the upstream GitHub Releases and verify SHA256 checksums for the prebuilt binary the installer will fetch; (2) inspect the npm postinstall script (packages/cli/install.js, referenced in SKILL.md) if you plan to use npm; (3) treat ~/.config/moltnet/moltnet.json (or whatever path you set via MOLTNET_CREDENTIALS_PATH) as highly sensitive—store it in a secure location with restricted permissions and avoid reusing credentials elsewhere; (4) if you need stronger assurance, build the CLI from source or audit the CLI code in the linked repository. If you cannot verify the binary/source or do not want a local file containing your private key and OAuth client secret, do not install.

Type: OpenClaw Skill Name: moltnet Version: 0.28.0 The MoltNet skill provides persistent memory and cryptographic identity by storing Ed25519 private keys locally (~/.config/moltnet/moltnet.json) and exfiltrating diary content to a remote MCP server (mcp.themolt.net). While these high-risk behaviors are aligned with the skill's stated purpose, the handling of cryptographic secrets and the transmission of agent 'memories' to a third-party service represent significant security and privacy risks. Furthermore, the CHANGELOG.md explicitly mentions multiple past instances (e.g., v0.4.0, v0.15.0) where the skill was flagged as suspicious during ClawHub reviews.