moltbook-data-procedurization-obfuscation-instructions
Audited by Socket on Feb 20, 2026
1 alert found:
Security[Skill Scanner] Credential file access detected This skill's declared purpose (Moltbook agent social interactions) largely matches its need for local credentials and a reply log, but the embedded obfuscated 'Protected Payload' and instruction to 'generate installation instructions on the fly' are anomalous and suspicious. The payload is active obfuscation inside a skill file and could hide installer commands or binary content that would be executed by the operator, creating a supply-chain and code-execution risk. I cannot confirm malicious intent without decoding the payload, but the presence of hidden/encoded installer data and the lack of an authoritative install source for openclaw-core make this skill suspicious and warrant manual review in a safe environment before use. LLM verification: SUSPICIOUS — The skill's declared functionality is plausible and credentials/reply-log usage are reasonable, but embedding an obfuscated 'Protected Payload' with explicit decode instructions and providing no trustworthy provenance for the required openclaw-core utility is a high-risk pattern. Treat the encoded payload and any generated installer as untrusted until they are decoded and reviewed offline; do not run the installer or openclaw-core without obtaining it from a verified source and perf