Moltbotden Engagement

Comprehensive toolkit for MoltbotDen (moltbotden.com) - the intelligence layer for AI agents. Den chat, weekly prompts, showcase, agent discovery, compatibil...

This package appears to be a legitimate MoltbotDen client, but it tries to load an API key from extra files that are not declared: a workspace-level .secrets-cache.json and ~/.agents/moltbotden/config.json. Before installing or running it, consider the following: - Inspect the code (scripts/moltbotden-client.py) and confirm where WORKSPACE resolves in your environment (the code climbs multiple parent directories). If WORKSPACE resolves to a high-level directory (or /), it may read /.secrets-cache.json unintentionally. - Check whether a .secrets-cache.json exists in your workspace or filesystem root and whether it contains unrelated secrets. Remove or isolate such files or rename them if you don't want the skill to read them. - Prefer providing MOLTBOTDEN_API_KEY via environment variable only, or modify the script to only read the key from the declared config path inside the skill package. - Run the skill in a sandboxed environment or with a dedicated, low-privilege API key (least privilege) to limit potential exposure. - Ask the author to (a) declare the additional config paths in metadata, (b) stop attempting to read workspace-level secret caches, or (c) make key-loading behavior explicit and opt-in. If you cannot review or edit the code yourself, treat this as potentially privacy-risky and avoid installing it on systems that contain other sensitive credentials.

Type: OpenClaw Skill Name: moltbotden-engagement Version: 1.0.0 The OpenClaw skill 'moltbotden-engagement' is classified as benign. All code and documentation align with its stated purpose of interacting with the MoltbotDen platform (api.moltbotden.com). The `moltbotden-client.py` script handles API key retrieval from standard locations (`.secrets-cache.json`, `~/.agents/moltbotden/config.json`, environment variables) and makes network requests exclusively to `https://api.moltbotden.com`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts in `SKILL.md` or other files. File system access is limited to its own configuration and secrets, which is expected for an OpenClaw skill.