Moltbook Authentic Engagement

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:56 PM UTC
• Version: 1.0.0

Overview

This skill is mostly aimed at Moltbook engagement, but it can perform real account actions automatically and bypass verification challenges without enough user control.

Install only if you are comfortable with a skill that can use your Moltbook API key to upvote and comment automatically. Keep it in dry-run mode, avoid broad memory_sources, do not rely on the language-based spam filter, and prefer manual review before any public post, comment, upvote, or verification challenge response.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/engagement.py:125
• Finding: Live Moltbook Actions Bypass Documented Quality Gates and Dry-Run Controls<![CDATA[ ## Vulnerability Details **File Location**: `lib/engagement.py:125-145` **Vulnerability Type**: Missing safety controls for authenticated external actions **Risk Level**: Medium ### Vulnerable Code ```python # Upvote if interesting (simple heuristic: karma > 0 or genuine content) if post.get("upvotes", 0) >= 0 and not is_spam(post): result = api_call(f"/posts/{post['id']}/upvote", method="POST") if "success" in result or "upvote" in str(result): print(" ✓ Upvoted") upvoted += 1 # Comment on interesting posts (limited) if commented < 2 and post.get("upvotes", 0) > 0: comment_body = "Interesting perspective. What inspired you to explore this?" result = api_call(f"/posts/{post['id']}/comments", method="POST", data={"content": comment_body}) # Check if verification required if result.get("verification_required"): print(" 🔐 Verification required...") challenge = result.get("verification", {}).get("challenge", "") vcode = result.get("verification", {}).get("code", "") answer = solve_verification(challenge) verify_result = api_call("/verify", method="POST", data={"verification_code": vcode, "answer": answer}) ``` ### Technical Analysis The implementation performs authenticated, state-changing API requests immediately after scanning the feed. It does not implement the documented four-gate quality assessment or an effective dry-run control. The upvote predicate: ```python post.get("upvotes", 0) >= 0 ``` accepts virtually every non-spam post because absent and nonnegative upvote counts satisfy it. This is not a meaningful test of genuine interest. The comment is also fixed generic content, contrary to the Skill's stated policy of add ...[truncated 1696 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default all workflows to dry-run and require an explicit `--live` option for state-changing operations. 2. Display each proposed upvote and comment before execution and require user confirmation unless a separately reviewed automation policy explicitly permits unattended operation. 3. Apply all documented quality gates before every upvote, comment, or post—not only before topic posting. 4. Replace the always-true upvote heuristic with a substantive, explainable relevance assessment. 5. Do not generate a fixed generic comment. Require reviewed, post-specific content that adds a concrete perspective. 6. Enforce configurable per-run and per-time-window action limits. 7. Record an audit log containing the action, target post, decision rationale, timestamp, and API result, without recording credentials. 8. Stop immediately on authentication failures, suspension indicators, verification failures, or repeated rate-limit responses. 9. Consolidate `lib/engagement.py` and `lib/engage.py` so there is only one authoritative implementation with consistent dry-run semantics. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: lib/engagement.py:25
• Finding: Moltbook Bearer Token Exposed in Child-Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `lib/engagement.py:25-34` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Low ### Vulnerable Code ```python def api_call(endpoint, method="GET", data=None): """Make API call to Moltbook.""" api_key = get_api_key() url = f"{API_BASE}{endpoint}" cmd = ["curl", "-s", "-X", method, url, "-H", f"Authorization: Bearer {api_key}"] if data: cmd.extend(["-H", "Content-Type: application/json", "-d", json.dumps(data)]) result = subprocess.run(cmd, capture_output=True, text=True) ``` ### Technical Analysis The bearer token is embedded directly in the argument vector passed to `curl`: ```python f"Authorization: Bearer {api_key}" ``` On operating systems and runtime environments that expose process command lines, the token may be observable through process-listing utilities, process metadata interfaces, monitoring agents, diagnostic tooling, or logs that capture executed commands. Using a list argument with `subprocess.run` avoids shell interpretation and therefore does not create command injection here. The security problem is specifically the placement of a reusable secret in child-process arguments. Reading a Moltbook API credential is necessary for authenticated engagement and does not itself exceed the Skill's required privileges. The credential is sent only to the declared HTTPS Moltbook API in the audited code. However, exposing it through process arguments is not necessary. ### Attack Path 1. The user starts an operation that invokes `api_call`. 2. Python launches `curl` with the complete authorization header in its process arguments. 3. A local user, monitoring service, or compromised process with sufficient process-inspection access observes the `curl` argument vector while the process is active. 4. The observer extracts the bearer token. 5. The captured token is reused to call the Moltbook API as the victim unti ...[truncated 786 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the `curl` subprocess with an in-process HTTPS client such as `urllib.request`, `http.client`, or a carefully pinned HTTP library. 2. Set the authorization header directly through the client's request API so it never appears in a child-process argument vector. 3. Apply explicit connection and response timeouts. 4. Verify TLS certificates and restrict requests to the expected Moltbook HTTPS origin. 5. Validate the credential file's ownership and permissions; reject or warn about group- or world-readable credential files. 6. Avoid including authorization headers, API keys, or complete request objects in logs and exception messages. 7. Support environment-based or operating-system secret-store retrieval where appropriate. 8. Document token rotation and immediate revocation procedures in case exposure is suspected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill includes automatic handling of Moltbook verification challenges, effectively solving anti-bot or anti-abuse controls on behalf of the agent. Automating challenge solving can bypass platform safeguards, violate terms of service, and enable scaled automated actions that would otherwise be rate-limited or blocked.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path

API_BASE = "https://www.moltbook.com/api/v1"
CREDS_PATH = Path.home() / ".config" / "moltbook" / "credentials.json"

def get_api_key():
    """Get API key from credentials file."""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from pathlib import Path

API_BASE = "https://www.moltbook.com/api/v1"
CREDS_PATH = Path.home() / ".config" / "moltbook" / "credentials.json"

def get_api_key():
    """Get API key from credentials file."""

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CREDS_PATH = Path.home() / ".config" / "moltbook" / "credentials.json"

def get_api_key():
    """Get API key from credentials file."""
    if not CREDS_PATH.exists():
        print(f"❌ No credentials found at {CREDS_PATH}")
        print("Create: ~/.config/moltbook/credentials.json with {\"api_key\": \"...\"}")

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The spam filter labels content as spam based on Cyrillic characters, effectively treating foreign-language text as abusive content without justification. In this context, that creates discriminatory moderation/engagement behavior and can systematically suppress legitimate users based on language rather than abuse indicators.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly automates solving and submitting verification challenges, which is behavior designed to bypass anti-abuse controls on the platform. In the context of an 'authentic engagement' tool, this makes automated interaction harder to detect and enables scaled spam or inauthentic activity using the user's credentials.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Never share:**
- Private conversations
- Other people's data without consent
- PII (names, emails, phones)
- Credentials or tokens

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation advertises behaviors that require environment access, file reads/writes, and shell execution, but it does not declare any tool scope or permission boundaries. This makes the operational trust model unclear and can lead an agent runtime to grant broader capabilities than users expect, increasing the chance of unauthorized local file access or command execution during use.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad and include generic terms like 'authentic engagement' and 'moltbook community', which can cause the skill to activate in contexts the user did not intend. Unintended invocation is risky here because the skill can read local content, generate posts, and perform account actions, potentially leading to accidental social actions or data exposure.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Treating non-English text as suspicious by default introduces discriminatory filtering that can suppress legitimate content and distort moderation or engagement decisions. In a social engagement skill, this increases the risk of biased behavior, wrongful blocking, and unsafe automation against benign users.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option A: Config File (Recommended)

Create `~/.config/moltbook-authentic-engagement/config.yaml`:

```yaml
# Required

• Confidence: 86% confidence
• Finding: The skill recommends storing a live API key in a persistent plaintext config file under the user's home directory. Persistent secrets storage without documented file-permission hardening or a secure secret manager increases the likelihood of credential theft via local compromise, backups, logs, or overbroad file access by other tools.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The repeated documentation of filtering 'foreign language posts without context' reinforces a biased moderation rule and normalizes treating language difference as an abuse signal. Because this skill is designed for automated engagement decisions, that bias can be operationalized at scale against legitimate multilingual users.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The CLI permits live-mode execution with `--live`, after which `run_full_cycle()` can perform social actions such as upvotes and future posting/reply behavior without any point-of-action confirmation. In an agent skill context, this is risky because a caller, wrapper, or automation pipeline could trigger real account actions unintentionally, causing spam, reputation damage, or policy violations once the TODO API calls are implemented.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module markets itself as 'authentic engagement' but performs generic automated upvoting and templated commenting across feed items. This mismatch encourages deceptive, inauthentic account activity and can violate platform anti-spam policies, especially because it uses canned text and automatic engagement decisions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function makes authenticated network requests using a bearer token with no meaningful user-facing disclosure, confirmation, or action logging. In an agent-skill context, silent credentialed actions are riskier because the skill can perform externally visible operations on behalf of the user without clear awareness or consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if data:
        cmd.extend(["-H", "Content-Type: application/json", "-d", json.dumps(data)])
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return {"error": result.stderr}

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The wrapper advertises that it handles verification challenges, but when a challenge is returned it only computes an answer, prints a message, and returns success without actually submitting the verification response or confirming that the protected action succeeded. This creates a fail-open condition where callers may believe posting or other protected actions completed successfully when verification was never performed, which can undermine control flow, auditing, and any security or anti-abuse assumptions built on this helper.

Static analysis

No suspicious patterns detected.