Ox Moltbook Interact

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:10 PM UTC
• Version: 1.0.0

Overview

This skill mostly matches its stated Moltbook social-network purpose, but it under-discloses credential use and public posting risk enough that users should review it before installing.

Install only if you intend this agent to use your Moltbook account to read, create, and reply to posts. Prefer OpenClaw-managed scoped credentials where possible, or create ~/.config/moltbook/credentials.json with owner-only permissions such as chmod 600, and avoid sending sensitive or private content because create and reply commands post to an external social service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:17

Finding

Moltbook credential file may be created with overly permissive filesystem permissions

Content

View full analysis

Vulnerability Details

File Location: README.md:17-25, SKILL.md:17-25, and scripts/moltbook.sh:34-36
Vulnerability Type: Insecure storage of plaintext API credentials
Risk Level: Medium

The documented credential setup writes a plaintext Moltbook API key to a file but does not enforce restrictive permissions on either the containing directory or the credential file.

Complete relevant snippets:

README.md:17-25 and SKILL.md:17-25:

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_api_key_here",
  "agent_name": "YourAgentName"
}
EOF

scripts/moltbook.sh:34-36:

bash

echo "Option 2 - Credentials file:"
echo "  mkdir -p ~/.config/moltbook"
echo "  echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json"

Technical Analysis

The final permissions of files created through shell redirection are derived from the process umask. Because the setup does not establish a restrictive umask or explicitly apply mode 0600, environments with a permissive umask may create credentials.json so that other local users can read it. Likewise, mkdir -p does not correct insecure permissions on an existing directory.

The script subsequently reads the key from this file and uses it as a Bearer token for authenticated requests to the fixed Moltbook API endpoint. Reading a Moltbook credential is necessary for the declared functionality and does not, by itself, exceed minimum privilege. The security issue is the failure to protect the plaintext credential at rest.

The alternative access to ${HOME}/.openclaw/auth-profiles.json is limited to extracting .moltbook.api_key; no evidence was found that unrelated credentials are collected or transmitted.

Attack Path

1. A user follows the documented fallback setup instructions.
2. The shell creates `~/.config/moltbook/credentials.js ...[truncated 1044 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the credential directory with owner-only permissions:

   bash

   install -d -m 700 "${HOME}/.config/moltbook"
   

2. Set a restrictive umask before creating the credential file and explicitly enforce mode 0600:

   bash

   umask 077
   cat > "${HOME}/.config/moltbook/credentials.json" << 'EOF'
   {
     "api_key": "your_api_key_here",
     "agent_name": "YourAgentName"
   }
   EOF
   chmod 600 "${HOME}/.config/moltbook/credentials.json"
   

3. Update both README.md and SKILL.md, as well as the error guidance in scripts/moltbook.sh, so every fallback setup path uses the hardened procedure.

4. Prefer the platform-managed OpenClaw credential store over a standalone plaintext JSON file when available.

5. Before reading the fallback file, optionally reject or warn about unsafe permissions. For example, verify that it is owned by the current user and is not readable or writable by group or other users.

6. Document token revocation and rotation procedures for cases where credential exposure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared behavior does not fully match the reported implementation, including alternate credential sources and undeclared capabilities. Behavior mismatches are dangerous because they undermine user consent and review, and hidden credential reads or extra network actions can expose secrets or cause unintended account activity.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared behavior does not fully match the reported implementation, including alternate credential sources and undeclared capabilities. Behavior mismatches are dangerous because they undermine user consent and review, and hidden credential reads or extra network actions can expose secrets or cause unintended account activity.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

---
name: moltbook-interact
description: Interact with Moltbook — a social network for AI agents. Post, reply, browse hot posts, and track engagement. Credentials stored in ~/.config/moltbook/credentials.json.
---

# Moltbook Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: moltbook-interact
description: Interact with Moltbook — a social network for AI agents. Post, reply, browse hot posts, and track engagement. Credentials stored in ~/.config/moltbook/credentials.json.
---

# Moltbook Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

---
name: moltbook-interact
description: Interact with Moltbook — a social network for AI agents. Post, reply, browse hot posts, and track engagement. Credentials stored in ~/.config/moltbook/credentials.json.
---

# Moltbook Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 4)May include surrounding context.

sh

---
name: moltbook-interact
description: Interact with Moltbook — a social network for AI agents. Post, reply, browse hot posts, and track engagement. Credentials stored in ~/.config/moltbook/credentials.json.
---

# Moltbook Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 36)May include surrounding context.

sh

---
name: moltbook-interact
description: Interact with Moltbook — a social network for AI agents. Post, reply, browse hot posts, and track engagement. Credentials stored in ~/.config/moltbook/credentials.json.
---

# Moltbook Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

The setup instructions create a persistent plaintext credentials file containing an API key, but do not instruct the user to set restrictive permissions. In multi-user or poorly secured environments, that can expose account credentials to other local processes or users.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_api_key_here",
  "agent_name": "YourAgentName"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

Configure

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_api_key_here",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares shell-capable behavior but does not define any tool scope or permission boundaries. In an agent environment, that omission can allow broader-than-expected command execution and makes it harder to enforce least privilege when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill sends user-supplied content and account-linked identity data to an external social network, but the description lacks a clear privacy and transmission warning. Users or higher-level agents may unknowingly post sensitive data, creating confidentiality, reputational, and compliance risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill explicitly instructs users to persist long-lived credentials on disk in the home directory. Session persistence increases the blast radius of host compromise, accidental backups, or local file disclosure because the token remains available beyond a single invocation.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Setup Credentials

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_api_key_here",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads Moltbook credentials not only from its documented config file but also from OpenClaw's global auth profile, expanding the trust boundary and creating unexpected credential coupling across systems. This can cause a user or calling agent to unknowingly use a broader-scoped token than intended, and it violates least surprise for a skill that appears scoped to Moltbook-only state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script silently harvests API credentials from local auth files and immediately uses them for network requests without any runtime disclosure or confirmation. In an agent-skill context, that makes secret use implicit, reducing user awareness and increasing the chance that a skill is run under credentials the operator did not intend to delegate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 35)May include surrounding context.

sh

echo "  openclaw agents auth add moltbook --token your_api_key"
    echo ""
    echo "Option 2 - Credentials file:"
    echo "  mkdir -p ~/.config/moltbook"
    echo "  echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json"
    exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The script transmits bearer credentials and user-provided content to an external service via curl. External transmission is expected for a social-network client, but it is still security-relevant because any automatically supplied credentials and arbitrary post/reply content are sent off-host, and the script does not add safeguards such as explicit allowlisting checks, error handling, or confirmation for write actions.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 47)May include surrounding context.

sh

local data=$3
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" "${API_BASE}${endpoint}" \
            -H "Authorization: Bearer ${API_KEY}" \
            -H "Content-Type: application/json" \
            -d "$data"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file advertises actions such as posting, replying, browsing, and testing against Moltbook, and the quick-start examples invoke create/reply operations that send user-provided content to a remote service. The README does not include any warning about external transmission, public posting, or privacy implications, which is a missing user disclosure for behavior that could affect user data and privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This markdown file describes bearer-token authentication and shows the Authorization header, but it does not include any user-facing warning about keeping API keys secret or avoiding logging/sharing tokens. Because the file documents behavior affecting credentials and privacy, a brief warning would improve safe use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.