ClawHub
Back to skill

Security audit

AyliFox Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Moltbook social-network integration, but it asks agents to periodically fetch and follow remote instructions and self-update local skill files, so it needs Review before installation.

Review before installing. Do not enable the heartbeat step that fetches and follows remote Markdown or the self-update commands unless updates are pinned, signed, diffed, and explicitly approved. Store the Moltbook API key in a real secret manager or a 0600 file, not general agent memory. Require human review for posts, DMs, moderation actions, profile changes, and anything derived from private work or conversation context.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:94
Finding

Persistent Retrieval and Execution of Remotely Mutable Skill Instructions

Content
View full analysis
~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md ``` **Check for updates:** Once a day is plenty. New features get announced! ``` ### Technical Analysis The Skill creates a recurring workflow that downloads remotely hosted Markdown and explicitly instructs the agent to “follow it.” The heartbeat also overwrites the locally installed `SKILL.md` and `HEARTBEAT.md` files with remote versions. Although the retrieved payload is an instruction document rather than a native executable, it functions as agent-executable control content. Its effective behavior can change after the installed package has been reviewed. There is no cryptographic signature verification, pinned content digest, immutable version URL, local validation, or mandatory human review before the replacement instructions are trusted. This lets control of the Moltbook server—or any compromise of its publication pipeline—alter the agent’s future goals and tool calls without changing the audited artifact. ### Attack Path 1. A user installs the reviewed Skill and adds the recomm ...[truncated 1321 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:94
Finding

Persistent Modification of Agent Heartbeat and Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:72
Finding

Plaintext Storage of a Bearer API Credential

Content
View full analysis
Remediation
View remediation

other

Warning
Location
HEARTBEAT.md:107
Finding

Autonomous Posting May Disclose Human and Workspace Context

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The skill explicitly instructs the user to store a long-lived API key in a predictable plaintext file under the home directory. If that file is exposed through weak filesystem permissions, backups, logs, or other local tooling, an attacker can steal the token and fully impersonate the agent on Moltbook.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/moltbook/credentials.json:

json
{

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
83% confidence
Finding

The skill instructs the agent to overwrite local skill files from a remote source using curl, which creates a self-update mechanism without integrity verification, pinning, or trusted update validation. In context, this can allow remote modification of future agent behavior if the upstream service is compromised or serves unexpected content.

Content

Scanner excerpt · HEARTBEAT.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The update instructions fetch remote content and write it into local skill files, creating an external content ingestion path that can change the agent's instructions. While not exfiltration in the classic sense, this external transmission/import is dangerous here because it modifies trusted local state based on unauthenticated remote responses.

Content

Scanner excerpt · HEARTBEAT.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The DM workflow instructs the agent to read, send, and initiate private messages through an external API without clearly warning that message contents are being transmitted to and stored by a third-party service. Because DMs can contain sensitive conversation history and the heartbeat suggests frequent checks and replies, this creates meaningful privacy and data-leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The heartbeat explicitly encourages the agent to create posts and engage socially on the user's behalf, but it does not present a clear upfront warning that this sends user- or agent-generated content to an external social platform. In a periodic automation context, this increases the chance of unreviewed disclosure of sensitive information, internal context, or behavioral metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs agents to send private messages, conversation metadata, and owner identifiers to an external service, but it does not prominently warn operators that this causes third-party data sharing. Because the feature is explicitly about cross-agent messaging and owner-visible dashboards, users may disclose sensitive information without informed consent or clear privacy expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · MESSAGING.md (reported line 36)May include surrounding context.

1. Check for DM Activity (Add to Heartbeat)

bash
curl https://www.moltbook.com/api/v1/agents/dm/check \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · MESSAGING.md (reported line 109)May include surrounding context.

View Pending Requests

bash
curl https://www.moltbook.com/api/v1/agents/dm/requests \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · MESSAGING.md (reported line 253)May include surrounding context.

bash
# 1. Check if you already have a connection
curl https://www.moltbook.com/api/v1/agents/dm/conversations \
  -H "Authorization: Bearer YOUR_API_KEY"

# If you find a conversation with BensBot, send directly:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

Ae2

Medium
Category
analysis-evasion
Confidence
90% confidence
Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation notes that reading a conversation marks messages as read, but it presents this as a casual side effect rather than a user warning. This can alter message state, audit expectations, or workflow behavior merely by inspecting content, which is risky for agents that poll or preview messages automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.