ClawHub
Back to skill

Security audit

Molt-Solver

Security checks for vulnerabilities and agentic risk

Overview

This skill solves Moltbook verification math, but its code also reads a local Moltbook API key and submits an authenticated verification request without clear documentation or consent.

Review before installing. Use this only if you are comfortable with the skill reading your local Moltbook credentials and submitting verification answers to Moltbook on your behalf. Prefer a version that clearly asks before using credentials and documents exactly what account state and API endpoints it accesses.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

Hardcoded access to a specific credentials.json path indicates the skill is designed to discover and use local secrets automatically. In this context, that is especially risky because the skill does not need credential access merely to parse arithmetic challenges, so the capability expands the blast radius from simple computation to potential unauthorized use of the user's Moltbook account.

Content

Scanner excerpt · molt-solver.ts (reported line 11)May include surrounding context.

ts
import * as path from 'path';

const BASE_URL = 'https://www.moltbook.com/api/v1';
const CRED_PATH = path.join(process.env.HOME || '', '.config/moltbook/credentials.json');

// ============================================
// Logic

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module presents itself as a math-solving utility, but it also contains functionality to authenticate with a local credential file and submit data to a remote verification API. This mismatch is dangerous because it can mislead users and reviewers about the skill's actual capabilities, reducing informed consent and making credential use and outbound data transfer less likely to be scrutinized.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code reads a credential file from the user's home directory and uses the API key for authenticated requests, even though the declared purpose is solving challenge text. In an agent skill context, undisclosed credential access plus outbound authenticated requests creates a meaningful risk of secret misuse, unauthorized account actions, or covert data exfiltration under the guise of benign functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The verification routine accesses a local credential file and performs an authenticated POST request without any visible warning, disclosure, or consent mechanism in this file. In a skill ecosystem, silent credential use and network activity are dangerous because users may invoke the tool expecting local computation only, while the skill actually transmits data and acts on their behalf.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language instructions and operational description are entirely in Chinese, which can force a specific language on users without opt-in. The file does not state that the skill is intended only for a Chinese-speaking audience or provide an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The markdown states that the skill depends on memory/moltbook-state.json to obtain account context, which indicates access to potentially user-related local state. The document does not include any warning or disclosure about reading this data, its purpose, or any privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
molt-solver.ts:11