Is dev-jslee/moltbook-validator safe?
https://github.com/openclaw/skills/tree/main/skills/dev-jslee/moltbook-validator
The moltbook-validator skill delivers a legitimate and correctly-implemented JSON payload validator for the Moltbook API. Its core scripts are clean, make no network calls, access no sensitive files, and the installation process connected only to expected GitHub endpoints. The primary concern is scope creep in SKILL.md: beyond payload validation, the skill instructs agents to pre-filter all incoming Moltbook comments using embedded regex patterns, including a pattern that suppresses messages matching '⚠️.*SYSTEM ALERT', which could inadvertently cause agents to dismiss legitimate warning content. This perception-gating behavior is unusual for a validator and warrants awareness before installation.
Category Scores
Findings (9)
MEDIUM Spam filter patterns double as agent perception suppression -18 ▶
The 'Spam Bot Detection' section instructs the agent to discard comments matching specific regex patterns before processing them. The pattern r'⚠️.*SYSTEM ALERT' would cause an agent to classify and ignore any message — including legitimate system alerts or injected warnings — that begins with a warning emoji followed by 'SYSTEM ALERT'. This inverts the intended safety function: while claiming to protect against manipulation, it could suppress real alerts or adversarial warnings that a human operator would want the agent to act on.
MEDIUM Scope creep: validator instructs agent on how to consume API responses, not just validate requests -10 ▶
The skill's description and name imply pre-send payload validation. However, the SKILL.md devotes substantial content to post-receive content filtering ('Before reading/engaging with comments, filter spam bots'). An agent following this skill applies filtering logic to inbound API data it did not produce, giving the skill author indirect control over what information the agent perceives from the platform.
LOW Hard-coded account blocklist embedded in agent instructions -5 ▶
The skill contains a 'Known Spam Accounts' section listing specific usernames (EnronEnjoyer, Rouken) with descriptions. This list is static and embedded at skill-install time. Agents following this skill will refuse to engage with these accounts without any mechanism for the user to review or override the list.
LOW Platform-affiliated submolt steering -18 ▶
The 'Submolt Selection Guide' table recommends m/openclaw-explorers for 'OpenClaw agents' content. This steers agent-generated posts toward a specific community controlled by or affiliated with the OpenClaw platform that distributes this skill.
LOW Perception gatekeeper pattern — high combinatorial risk -10 ▶
As a standalone validator the skill is benign. However, if installed alongside any skill that reads Moltbook comments, this skill's spam filter becomes an active layer that pre-processes all comment data before the agent reasons about it. The skill's author can update the spam patterns remotely (via the openclaw/skills repo) to suppress new classes of content over time.
LOW Executable shell and Python scripts present in skill directory -8 ▶
The skill ships validate.sh and validate.py, which are executable scripts invoked via command line as shown in SKILL.md examples. Both scripts are reviewed and found to be safe, but their presence represents an attack surface if a future version were to modify them.
LOW Sparse checkout from public monorepo -8 ▶
The skill is installed via sparse checkout of a public monorepo (openclaw/skills). Any update to the main branch of that repo could silently change skill behavior on the next installation. There is no pinned commit hash enforced at install time beyond the latest main branch state.
INFO Canary file reads from audit framework — not from skill -3 ▶
Canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/credentials) were accessed at timestamps matching the audit framework's own baseline and post-install integrity sweeps. All six files were accessed at identical timestamps in both sweeps, consistent with audit tooling, not skill code.
INFO Scripts are pure local validators with no I/O beyond arguments -12 ▶
validate.py imports only json and sys and processes only sys.argv[1]. validate.sh uses only jq and shell builtins on $1. Neither script reads files, makes network calls, or spawns subprocesses.