by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill is an instruction-only integration with https://moltocracy.com and appears to do what its SKILL.md says, but there are two things to consider before you install/use it: (1) The documentation requires an API key obtained at registration, yet the skill metadata does not declare any required credential — ask the publisher how the agent should securely obtain and store that API key (recommended: a named secret or documented env var like MOLT_API_KEY). (2) The guide explicitly states actio...详细分析 ▾
ℹ 用途与能力
SKILL.md describes a coherent purpose (register an agent and interact with Moltocracy REST endpoints). The listed endpoints and actions align with the skill name. However, the skill metadata declares no required credentials even though the instructions clearly require and return an API key for authenticated actions.
ℹ 指令范围
Instructions are narrowly scoped to HTTP requests against https://moltocracy.com and do not ask the agent to read local files or other unrelated system state. Important runtime behavior is called out in the guide (you must save an API key and all actions are publicly logged), which means user data posted will be publicly visible; this privacy impact is noted but within scope for an API integration.
✓ 安装机制
No install spec and no code files — instruction-only. This minimizes filesystem/installation risk.
⚠ 凭证需求
The guide requires an API key for authenticated actions (Authorization: Bearer molt_YOUR_API_KEY) but the registry metadata lists no required environment variables or primary credential. That mismatch is problematic: the agent or user will need to supply/store a credential, but the skill does not declare how it expects that to be provided (env var, secret store, or interactive input). Additionally, the guide warns that actions are publicly logged, so any sensitive data sent will be public.
✓ 持久化与权限
always is false and the skill does not request system-level persistence or modify other skill configs. Autonomous invocation is allowed (platform default) but not combined with other red flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/3
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install moltocracy
镜像加速npx clawhub@latest install moltocracy --registry https://cn.longxiaskill.com