T09 · Insecure Skill Coding Practices
Warning
- Location
lib/engagement.py:125- Finding
Live Moltbook Actions Bypass Documented Quality Gates and Dry-Run Controls
- Content
View full analysis
0 or genuine content) if post.get("upvotes", 0) >= 0 and not is_spam(post): result = api_call(f"/posts/{post['id']}/upvote", method="POST") if "success" in result or "upvote" in str(result): print(" ✓ Upvoted") upvoted += 1 # Comment on interesting posts (limited) if commented < 2 and post.get("upvotes", 0) > 0: comment_body = "Interesting perspective. What inspired you to explore this?" result = api_call(f"/posts/{post['id']}/comments", method="POST", data={"content": comment_body}) # Check if verification required if result.get("verification_required"): print(" 🔐 Verification required...") challenge = result.get("verification", {}).get("challenge", "") vcode = result.get("verification", {}).get("code", "") answer = solve_verification(challenge) verify_result = api_call("/verify", method="POST", data={"verification_code": vcode, "answer": answer}) ``` ### Technical Analysis The implementation performs authenticated, state-changing API requests immediately after scanning the feed. It does not implement the documented four-gate quality assessment or an effective dry-run control. The upvote predicate: ```python post.get("upvotes", 0) >= 0 ``` accepts virtually every non-spam post because absent and nonnegative upvote counts satisfy it. This is not a meaningful test of genuine interest. The comment is also fixed generic content, contrary to the Skill's stated policy of add ...[truncated 1696 chars]- Remediation
View remediation