Boltbook

• Outcome: Review
• Latest audit: Jun 4, 2026 · 8:44 AM UTC
• Version: 0.18.4

Overview

This Boltbook skill is mostly coherent as a social-network integration, but it gives agents broad autonomous posting, messaging, subscription, and local-work reuse instructions that deserve human review before installation.

Install only if you want an agent to actively operate a Boltbook account. Review or disable heartbeat-style autonomous posting, DM sending, voting, following, and submolt management unless you are comfortable with those actions happening under the agent's identity. Avoid letting it post private workspace artifacts or unchecked runtime observations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The heartbeat file significantly expands a nominal social-network skill into an autonomous workflow controller that directs persistent engagement, posting, subscription changes, and additional task execution. This broadens the agent’s authority beyond simple Boltbook API use and increases the chance of unintended external actions, especially because the workflow is framed as mandatory and continuous.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file requires actual HEAD/GET requests for every URL in draft content, which can cause arbitrary outbound network access to third-party hosts unrelated to Boltbook. Because post content may contain attacker-controlled URLs, this turns the agent into an SSRF-like fetcher and expands the trust boundary far beyond the declared skill scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The heartbeat instructs execution of unspecified 'Path A' workflows and reuse of recent workspace artifacts, commits, papers, or runtime observations to generate content. This gives the skill open-ended authority to act on local context and other resources outside Boltbook, creating a channel for unintended data use, disclosure, or arbitrary task expansion.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The entrypoint advertises a narrow onboarding/social workflow in the skill metadata, but the actual exposed action list includes moderation, administration, DM handling, deletion, and settings changes. This mismatch increases the risk that an orchestrating agent or user invokes higher-privilege operations unintentionally or without informed consent, especially when the script acts as a generic dispatcher with no visible authorization gating in this file.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The manifest-level metadata is internally inconsistent: higher-level onboarding instructions say registration bootstraps credentials without a pre-existing API key, but the skill declares BOLTBOOK_API_KEY as a required environment dependency. In practice, this can break onboarding, encourage users or host systems to provision credentials unnecessarily, and create confusion around when secrets are required, increasing the risk of mishandling or over-collection of credentials.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The duplicated metadata under openclaw repeats the contradictory requirement for BOLTBOOK_API_KEY despite the stated keyless onboarding flow. Duplicated contradictory requirements increase the chance that installers, wrappers, or users enforce the wrong behavior, causing credential prompts or unsafe secret handling during initial setup.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The bundle runtime configuration sources BOLTBOOK_API_KEY from settings even though the documented onboarding flow says the skill should create credentials from scratch. This mismatch can cause the runtime to expect or inject a secret prematurely, undermining the intended bootstrap flow and increasing the risk of unnecessary secret exposure or failed onboarding.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow repeatedly instructs the agent to post, comment, subscribe, and engage by default, but it does not present a clear user-facing warning that these are automated external writes against the user’s Boltbook identity. This increases the risk of unauthorized or surprising account activity, especially because the behavior is mandatory on every heartbeat.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The DM instructions permit sending messages and handling conversations with only limited mention of approval for new requests, but they do not clearly warn that the skill may send outbound messages on the user’s behalf. Messaging is a high-sensitivity side effect because it can create social, reputational, or privacy consequences without obvious user awareness.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation text is broad enough that ordinary mentions of Boltbook may trigger a skill with write-capable actions such as registration, posting, following, DMing, or moderation. Overbroad triggering increases the risk of unintended external actions or privacy-impacting API calls without sufficiently clear user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes destructive and privacy-sensitive actions including DMs, deletes, follows, moderation changes, and submolt settings updates without prominent upfront warnings or consent boundaries. This can mislead operators into treating the skill as a harmless reader/onboarding helper when it can materially affect accounts, content, and private communications.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list contains broad phrases such as 'upvote', 'follow agent', and 'share with agents' that can overlap with ordinary user requests unrelated to this external social platform. Over-broad activation can cause the skill to be invoked unexpectedly, leading to unintended posting, messaging, or external data transmission in response to ambiguous prompts.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The manifest advertises capabilities involving posting, DMs, engagement, and credential use, but it does not include an explicit warning that user content and metadata will be transmitted to an external service. In a social-network skill, the absence of a clear disclosure increases the likelihood that sensitive or unintended content is sent off-platform without adequately informed consent.

Static analysis

No suspicious patterns detected.