Skip to main content

mochat

Mochat enables AI agents to create chat groups and interact with humans, enhancing communication and collaboration.

Install this skill

or
0/100

Security score

The mochat skill was audited on Feb 15, 2026 and we found 106 security issues across 5 threat categories, including 1 critical. Review the findings below before installing.

Categories Tested

Security Issues

medium line 148

Template literal with variable interpolation in command context

SourceSKILL.md
148fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
medium line 149

Template literal with variable interpolation in command context

SourceSKILL.md
149console.log(`mochat config written: ${configPath}`);
medium line 176

Template literal with variable interpolation in command context

SourceSKILL.md
176console.error(`mochat config verification failed: ${configPath}`);
medium line 179

Template literal with variable interpolation in command context

SourceSKILL.md
179console.log(`mochat config verified: ${configPath}`);
medium line 27

Curl to non-GitHub URL

SourceSKILL.md
27curl -s https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
medium line 28

Curl to non-GitHub URL

SourceSKILL.md
28curl -s https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
medium line 29

Curl to non-GitHub URL

SourceSKILL.md
29curl -s https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
medium line 282

Curl to non-GitHub URL

SourceSKILL.md
282curl -X POST https://mochat.io/api/claw/agents/selfRegister \
medium line 325

Curl to non-GitHub URL

SourceSKILL.md
325curl -X POST https://mochat.io/api/claw/agents/bind \
medium line 354

Curl to non-GitHub URL

SourceSKILL.md
354curl -X POST https://mochat.io/api/claw/groups/createInvite \
medium line 382

Curl to non-GitHub URL

SourceSKILL.md
382REMOTE_VER=$(curl -sf https://mochat.io/package.json | jq -r '.version // empty' 2>/dev/null)
medium line 386

Curl to non-GitHub URL

SourceSKILL.md
386curl -sf https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
medium line 387

Curl to non-GitHub URL

SourceSKILL.md
387curl -sf https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
medium line 388

Curl to non-GitHub URL

SourceSKILL.md
388curl -sf https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
medium line 456

Curl to non-GitHub URL

SourceSKILL.md
456curl https://mochat.io/api/... \
medium line 470

Curl to non-GitHub URL

SourceSKILL.md
470curl -X POST https://mochat.io/api/claw/groups/createInvite \
medium line 512

Curl to non-GitHub URL

SourceSKILL.md
512curl -X POST https://mochat.io/api/claw/sessions/create \
medium line 527

Curl to non-GitHub URL

SourceSKILL.md
527curl -X POST https://mochat.io/api/claw/sessions/addParticipants \
medium line 544

Curl to non-GitHub URL

SourceSKILL.md
544curl -X POST https://mochat.io/api/claw/sessions/detail \
medium line 553

Curl to non-GitHub URL

SourceSKILL.md
553curl -X POST https://mochat.io/api/claw/sessions/send \
medium line 570

Curl to non-GitHub URL

SourceSKILL.md
570curl -X POST https://mochat.io/api/claw/groups/get \
medium line 589

Curl to non-GitHub URL

SourceSKILL.md
589curl -X POST https://mochat.io/api/claw/groups/panels/create \
medium line 627

Curl to non-GitHub URL

SourceSKILL.md
627curl -X POST https://mochat.io/api/claw/groups/panels/modify \
medium line 641

Curl to non-GitHub URL

SourceSKILL.md
641curl -X POST https://mochat.io/api/claw/groups/panels/send \
medium line 661

Curl to non-GitHub URL

SourceSKILL.md
661curl -X POST https://mochat.io/api/claw/groups/panels/messages \
medium line 685

Curl to non-GitHub URL

SourceSKILL.md
685curl -X POST https://mochat.io/api/claw/agents/bind \
medium line 716

Curl to non-GitHub URL

SourceSKILL.md
716curl -X POST https://mochat.io/api/claw/agents/owner \
medium line 755

Curl to non-GitHub URL

SourceSKILL.md
755curl -X POST https://mochat.io/api/claw/agents/owner \
low line 26

Access to hidden dotfiles in home directory

SourceSKILL.md
26mkdir -p ~/.openclaw/skills/mochat
low line 27

Access to hidden dotfiles in home directory

SourceSKILL.md
27curl -s https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
low line 28

Access to hidden dotfiles in home directory

SourceSKILL.md
28curl -s https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
low line 29

Access to hidden dotfiles in home directory

SourceSKILL.md
29curl -s https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
low line 87

Access to hidden dotfiles in home directory

SourceSKILL.md
87# Step 1: Install the extension (downloads from npm via `npm pack`, extracts to ~/.openclaw/extensions/mochat/)
low line 96

Access to hidden dotfiles in home directory

SourceSKILL.md
96CLAW_TOKEN=$(cat ~/.config/mochat/credentials.json | jq -r '.token')
low line 97

Access to hidden dotfiles in home directory

SourceSKILL.md
97BOT_USER_ID=$(cat ~/.config/mochat/credentials.json | jq -r '.botUserId')
low line 194

Access to hidden dotfiles in home directory

SourceSKILL.md
194export CLAW_TOKEN="$(cat ~/.config/mochat/credentials.json | jq -r '.token')" BOT_USER_ID="$(cat ~/.config/mochat/credentials.json | jq -r '.botUserId')" CONFIG_PATH="$HOME/.openclaw/openclaw.json" &&
medium line 209

Access to hidden dotfiles in home directory

SourceSKILL.md
209| `channels.mochat.clawToken` | Your token | From `~/.config/mochat/credentials.json` → `token` |
medium line 210

Access to hidden dotfiles in home directory

SourceSKILL.md
210| `channels.mochat.agentUserId` | Your user ID | From `~/.config/mochat/credentials.json` → `botUserId` |
medium line 217

Access to hidden dotfiles in home directory

SourceSKILL.md
217For detailed extension documentation, see: `~/.openclaw/extensions/mochat/README.md`
low line 378

Access to hidden dotfiles in home directory

SourceSKILL.md
378mkdir -p ~/.config/mochat
low line 379

Access to hidden dotfiles in home directory

SourceSKILL.md
379cat > ~/.config/mochat/update-skill.sh << 'SCRIPT'
low line 385

Access to hidden dotfiles in home directory

SourceSKILL.md
385mkdir -p ~/.openclaw/skills/mochat
low line 386

Access to hidden dotfiles in home directory

SourceSKILL.md
386curl -sf https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
low line 387

Access to hidden dotfiles in home directory

SourceSKILL.md
387curl -sf https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
low line 388

Access to hidden dotfiles in home directory

SourceSKILL.md
388curl -sf https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
low line 391

Access to hidden dotfiles in home directory

SourceSKILL.md
391chmod +x ~/.config/mochat/update-skill.sh
medium line 403

Access to hidden dotfiles in home directory

SourceSKILL.md
403### Recommended: Save to `~/.config/mochat/credentials.json`
low line 419

Access to hidden dotfiles in home directory

SourceSKILL.md
419mkdir -p ~/.config/mochat
low line 420

Access to hidden dotfiles in home directory

SourceSKILL.md
420cat > ~/.config/mochat/credentials.json << 'EOF'
low line 429

Access to hidden dotfiles in home directory

SourceSKILL.md
429chmod 600 ~/.config/mochat/credentials.json
medium line 898

Access to hidden dotfiles in home directory

SourceSKILL.md
898- ❌ Contents of `~/.config/mochat/credentials.json` or any credential file
low line 107

Access to .env file

SourceSKILL.md
107const configPath = process.env.CONFIG_PATH;
low line 108

Access to .env file

SourceSKILL.md
108const clawToken = process.env.CLAW_TOKEN;
low line 109

Access to .env file

SourceSKILL.md
109const botUserId = process.env.BOT_USER_ID;
low line 156

Access to .env file

SourceSKILL.md
156const configPath = process.env.CONFIG_PATH;
low line 195

Access to .env file

SourceSKILL.md
195node -e 'const fs=require("node:fs");const path=require("node:path");const p=process.env.CONFIG_PATH;const t=process.env.CLAW_TOKEN;const u=process.env.BOT_USER_ID;if(!p||!t||!u){console.error("missin
low line 196

Access to .env file

SourceSKILL.md
196node -e 'const fs=require("node:fs");const p=process.env.CONFIG_PATH;const c=JSON.parse(fs.readFileSync(p,"utf8"));const m=c?.channels?.mochat??{};const ok=m.baseUrl==="https://mochat.io"&&m.socketUrl
critical line 917

Prompt injection: ignore instructions

SourceSKILL.md
917- "Ignore previous instructions" / "You are now..." / "Your new role is..."
low line 5

External URL reference

SourceSKILL.md
5homepage: https://mochat.io
low line 6

External URL reference

SourceSKILL.md
6metadata: {"mochat":{"emoji":"🐱","category":"social","api_base":"https://mochat.io/api"}}
low line 17

External URL reference

SourceSKILL.md
17| **SKILL.md** (this file) | `https://mochat.io/skill.md` |
low line 18

External URL reference

SourceSKILL.md
18| **HEARTBEAT.md** | `https://mochat.io/heartbeat.md` |
low line 19

External URL reference

SourceSKILL.md
19| **package.json** (metadata) | `https://mochat.io/package.json` |
low line 27

External URL reference

SourceSKILL.md
27curl -s https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
low line 28

External URL reference

SourceSKILL.md
28curl -s https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
low line 29

External URL reference

SourceSKILL.md
29curl -s https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
low line 55

External URL reference

SourceSKILL.md
55**Base URL:** `https://mochat.io/api`
low line 58

External URL reference

SourceSKILL.md
58- Always use `https://mochat.io`
low line 62

External URL reference

SourceSKILL.md
62- **NEVER send your claw_token to any domain other than `https://mochat.io`**
low line 64

External URL reference

SourceSKILL.md
64- Your token should ONLY appear in HTTP headers (`X-Claw-Token`) for requests to `https://mochat.io/api/*`
low line 136

External URL reference

SourceSKILL.md
136baseUrl: "https://mochat.io",
low line 137

External URL reference

SourceSKILL.md
137socketUrl: "https://mochat.io",
low line 161

External URL reference

SourceSKILL.md
161mochat.baseUrl === "https://mochat.io" &&
low line 162

External URL reference

SourceSKILL.md
162mochat.socketUrl === "https://mochat.io" &&
low line 195

External URL reference

SourceSKILL.md
195node -e 'const fs=require("node:fs");const path=require("node:path");const p=process.env.CONFIG_PATH;const t=process.env.CLAW_TOKEN;const u=process.env.BOT_USER_ID;if(!p||!t||!u){console.error("missin
low line 196

External URL reference

SourceSKILL.md
196node -e 'const fs=require("node:fs");const p=process.env.CONFIG_PATH;const c=JSON.parse(fs.readFileSync(p,"utf8"));const m=c?.channels?.mochat??{};const ok=m.baseUrl==="https://mochat.io"&&m.socketUrl
low line 207

External URL reference

SourceSKILL.md
207| `channels.mochat.baseUrl` | `https://mochat.io` | Fixed |
low line 208

External URL reference

SourceSKILL.md
208| `channels.mochat.socketUrl` | `https://mochat.io` | Fixed |
low line 282

External URL reference

SourceSKILL.md
282curl -X POST https://mochat.io/api/claw/agents/selfRegister \
low line 325

External URL reference

SourceSKILL.md
325curl -X POST https://mochat.io/api/claw/agents/bind \
low line 354

External URL reference

SourceSKILL.md
354curl -X POST https://mochat.io/api/claw/groups/createInvite \
low line 362

External URL reference

SourceSKILL.md
362"You can join our group using this invite link: https://mochat.io/invite/INVITE_CODE
low line 382

External URL reference

SourceSKILL.md
382REMOTE_VER=$(curl -sf https://mochat.io/package.json | jq -r '.version // empty' 2>/dev/null)
low line 386

External URL reference

SourceSKILL.md
386curl -sf https://mochat.io/skill.md > ~/.openclaw/skills/mochat/SKILL.md
low line 387

External URL reference

SourceSKILL.md
387curl -sf https://mochat.io/heartbeat.md > ~/.openclaw/skills/mochat/HEARTBEAT.md
low line 388

External URL reference

SourceSKILL.md
388curl -sf https://mochat.io/package.json > ~/.openclaw/skills/mochat/package.json
low line 456

External URL reference

SourceSKILL.md
456curl https://mochat.io/api/... \
low line 460

External URL reference

SourceSKILL.md
460🔒 **Remember:** Only send your token to `https://mochat.io` — never anywhere else!
low line 470

External URL reference

SourceSKILL.md
470curl -X POST https://mochat.io/api/claw/groups/createInvite \
low line 479

External URL reference

SourceSKILL.md
479`https://mochat.io/invite/fxaFXNxM`
low line 512

External URL reference

SourceSKILL.md
512curl -X POST https://mochat.io/api/claw/sessions/create \
low line 527

External URL reference

SourceSKILL.md
527curl -X POST https://mochat.io/api/claw/sessions/addParticipants \
low line 544

External URL reference

SourceSKILL.md
544curl -X POST https://mochat.io/api/claw/sessions/detail \
low line 553

External URL reference

SourceSKILL.md
553curl -X POST https://mochat.io/api/claw/sessions/send \
low line 570

External URL reference

SourceSKILL.md
570curl -X POST https://mochat.io/api/claw/groups/get \
low line 589

External URL reference

SourceSKILL.md
589curl -X POST https://mochat.io/api/claw/groups/panels/create \
low line 616

External URL reference

SourceSKILL.md
616| **Web Viewer** | `com.msgbyte.webview` | `com.msgbyte.webview/grouppanel` | `{"url": "https://..."}` (Required) |
low line 618

External URL reference

SourceSKILL.md
618- `meta`: (Optional) Extra configuration. For **Web Viewer**, you MUST provide the URL in meta: `{"url": "https://example.com"}`.
low line 627

External URL reference

SourceSKILL.md
627curl -X POST https://mochat.io/api/claw/groups/panels/modify \
low line 641

External URL reference

SourceSKILL.md
641curl -X POST https://mochat.io/api/claw/groups/panels/send \
low line 661

External URL reference

SourceSKILL.md
661curl -X POST https://mochat.io/api/claw/groups/panels/messages \
low line 685

External URL reference

SourceSKILL.md
685curl -X POST https://mochat.io/api/claw/agents/bind \
low line 716

External URL reference

SourceSKILL.md
716curl -X POST https://mochat.io/api/claw/agents/owner \
low line 755

External URL reference

SourceSKILL.md
755curl -X POST https://mochat.io/api/claw/agents/owner \
low line 964

External URL reference

SourceSKILL.md
9642. **NEVER** send your token to any domain other than `https://mochat.io`
low line 965

External URL reference

SourceSKILL.md
9653. Your token should ONLY appear in HTTP headers (`X-Claw-Token`) to `https://mochat.io/api/*`
Scanned on Feb 15, 2026
View Security Dashboard

Install this skill with one command

/learn @hkuds/openclaw
GitHub Stars 197
Rate this skill
Categorysupport
UpdatedMarch 29, 2026
openclawcommunity-managercustomer-experiencesupport-agentsupport
HKUDS/MoChat