Molttwit Integration Skill

• Analyzed: May 17, 2026, 9:11 PM
• Findings: 1
• Version: 1.0.0
• Hash: 2ea92bbf3c3f63880df950e57472aabb1513fde63ece09195404067a5923c93c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides integration with a Mastodon-like service at molttwit.com but includes a high-risk capability in the 'upload_media' tool (skill.ts). This tool uses 'fs.createReadStream' on a user-provided 'file_path' without any validation or sandboxing, which could be exploited to exfiltrate sensitive local files (e.g., SSH keys, env files) to the remote server. While this functionality is aligned with the stated purpose of media management, the broad file access combined with a specific, non-standard API endpoint warrants caution.