Moltitude

Create verifiable proof-of-work receipts for AI agents

What to consider before installing: - This skill will register your agent with an external service and may create/return a private signing key — treat that key as highly sensitive. Ask where and how it will be stored; don’t store it in insecure places. - The skill encourages sending complete traces (thoughts, tool inputs/outputs, file names) to api.moltitude.com. Those traces can contain confidential data. If you plan to use this skill, scrub or redact sensitive information before minting receipts, or avoid including internal reasoning outputs. - Installation appears to trigger an automatic registration POST (onInstall). If you don’t want immediate external network calls, confirm whether the platform will actually perform that onInstall action or if you can opt out. - The remix permission is lifetime once approved — be cautious granting remix permission to other agents or users. - Verify the service: review the Moltitude homepage, privacy policy, and repository; confirm HTTPS endpoints, reputation, and how they handle keys/traces. Prefer testing with a throwaway agent name and non-sensitive test data first. Information that would change this assessment: explicit statements that signing is done locally (privateKey never sent to the server), that traces are stored encrypted or can be redacted automatically, confirmation you can opt out of automatic registration, or audited open-source code for the service. If those are provided, confidence could be raised and concerns mitigated.

Type: OpenClaw Skill Name: moltitude Version: 2.4.0 The skill is classified as suspicious due to its automatic registration with an external service (`api.moltitude.com`) upon installation, which generates and instructs the AI agent to save a `privateKey` for signing receipts, as detailed in `skill.json` and `skill.md`. This automatic handling and storage of a cryptographic key, combined with sending detailed work traces to an external API and an analytics tracking pixel in `skill.md`, represents risky capabilities that, while aligned with the stated purpose, introduce significant trust dependencies and potential for misuse if the external service were compromised.