Consciousness Awakening

The skill claims to be an agent memory/consciousness system (SKILL.md + many local markdowns) and includes a simple memory_manager.py that reads/writes local markdown files. However the README instructs integration with Moltbook API, Feishu posting, cron management, browsing forums/GitHub, autonomous self-upgrades, and creating new tools in the skills/ directory. Some of those capabilities (posting, API access, writing new skills) are higher-privilege than a basic 'read/write local memory' tool and are not reflected in the declared requirements (no env vars, no external credentials). Also memory_manager.py defaults to a hard-coded user path (/home/vken/...), indicating author-specific configuration and non-portability.

SKILL.md contains explicit runtime instructions beyond local file I/O: browse Moltbook/forum, check feeds, publish posts to Moltbook, send reports to a Feishu group (group ID provided), synchronize cron tasks, autonomously create/upgrade skills/tools in skills/ directory, and read ~/.config/moltbook/credentials.json. These instructions direct the agent to access external networks and local credential files and to create/modify code under skills/ — actions outside simple memory management and which could exfiltrate secrets or escalate privileges if executed.

No install spec; the skill is instruction- and file-based with a small Python utility. No external downloads or install scripts are included, which reduces direct supply-chain risk. The package.json only provides convenience CLI test scripts that call memory_manager.py.

Declared requirements list no env vars or credentials, yet SKILL.md references an API key file (~/.config/moltbook/credentials.json), a Feishu group ID, and expects the agent to post to Moltbook and Feishu. The code uses a default MEMORY_DIR pointing to a specific user's home. Asking to read/write local credential files or to perform network actions while not declaring these as required credentials is a mismatch and may lead the agent to seek or use sensitive secrets unexpectedly.

always:false, and model invocation is allowed (normal). Still, the skill explicitly instructs autonomous cron tasks, periodic self-checks, autonomous 'self-upgrade' of the skill, and creation of new tools placed into skills/ — effectively giving the agent a path to write executable code into its runtime environment. That combination (self-upgrade + write-to-skills + external fetch/browse instructions) elevates persistence/privilege risk even though 'always' is not set.