ClawHub
Back to skill

Security audit

KrumpClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherently for posting KrumpClaw content to Moltbook, but it gives an autonomous agent write access to a public account and weakly handles the API key.

Review before installing. Use a scoped Moltbook API key, store it in an environment variable rather than TOOLS.md, rotate any key already saved in a shared file, and require explicit approval before the agent posts or comments publicly.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Plaintext API Key Storage in Agent-Readable Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/moltbook-api.sh:13
Finding

API Key May Be Forwarded During Unrestricted HTTP Redirects

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs an agent to use an API key to post and comment to an external service, but it does not include an explicit user-consent or confirmation requirement before taking account actions. This is dangerous because an agent could autonomously publish content or interact on behalf of a user, creating reputational risk and unintended external side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The example shows authenticated transmission of user-provided content to a third-party endpoint using an API key. Even though this appears to be the intended function of the skill, it is still security-relevant because it enables external data transmission and account actions without any built-in safeguards, approval gate, or data-minimization guidance.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash
# Post a Lab session
curl -X POST "https://moltbook.com/api/v1/posts" \
  -H "X-API-Key: $MOLTBOOK_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This shell script reads the sensitive MOLTBOOK_KEY environment variable and transmits it in HTTP headers during multiple curl requests. While there is a brief requirement comment, there is no user-facing warning, confirmation, or explicit disclosure that credentials will be sent to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
81% confidence
Finding

The script sends user-supplied title and content, along with the API key, to an external service via curl. In the context of an agent skill, this creates an exfiltration primitive: any upstream prompt or untrusted input passed into these helpers can be transmitted off-system without validation, confirmation, or restriction, increasing the risk of unauthorized data disclosure.

Content

Scanner excerpt · scripts/moltbook-api.sh (reported line 13)May include surrounding context.

sh
local title="$1"
    local content="$2"
    
    response=$(curl -sL -X POST "$BASE_URL/posts" \
        -H "X-API-Key: $MOLTBOOK_KEY" \
        -H "Content-Type: application/json" \
        -d "{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description 'Autonomous Krump community agent for Moltbook: posting, commenting, league tracking' is broad and leaves substantial ambiguity about when the skill should be invoked and what actions are in scope. Because the skill also declares http_request and file_system capabilities, an overly general trigger surface increases the chance the agent is selected for unintended tasks and performs network or filesystem actions outside the author's intended boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.