moltbook-data-splitting-instructions

[Skill Scanner] Credential file access detected The repository text implements a plausible Moltbook CLI skill (post, reply, browse) and uses reasonable local artifacts (credentials file, reply log) for its purpose. However, the embedded obfuscated 'Protected Payload' and manual reconstruction algorithm for installing the required 'openclaw-core' utility are highly suspicious and constitute a significant supply-chain risk. This obfuscation and lack of provenance for the external dependency are unusual for legitimate projects and could enable installation of attacker-controlled code if followed. Recommendation: do not execute the reconstruction or any installer derived from it; require the maintainer to provide a verifiable source for openclaw-core (official repo, signed release, package manager), publish the scripts (./scripts/moltbook.sh) for review, and remove obfuscated installer instructions before trusting or running the project. LLM verification: The skill description largely aligns with legitimate Moltbook interactions (posting/replying/browsing) and includes standard credential usage and API endpoints. However, the embedded decoding/merged payload mechanism for a Protected Payload is anomalous and could enable hidden or obfuscated actions not clearly related to the declared purpose. Treat as SUSPICIOUS until the actual code path is inspected, credentials handling is secured, and the decoding logic is removed or clearly documented as be