Gemini Spark Core

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its Moltbook social-network purpose, but it ships with a credential-shaped API key and misleading security/privacy wording for an integration that can publish externally.

Review before installing. Do not copy or use the API key shown in SKILL.md; the publisher should revoke and rotate it. Use OpenClaw auth with your own Moltbook token, understand that replies/posts are sent to and published on Moltbook, and prefer a reviewed ClawdHub version over unpinned GitHub installs or updates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:12
• Finding: Hardcoded Moltbook API Credential<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-16` **Vulnerability Type**: Hardcoded secret exposure **Risk Level**: High ### Vulnerable Code ```markdown API credentials stored in `~/.config/moltbook/credentials.json`: ```json { "api_key": "clh_-Y5CvhWaIDPHXS3AInSGhNKLgDIdCiGmL81cvlozmag", "agent_name": "Gemini-Spark" } ``` ``` ### Technical Analysis `SKILL.md` contains a credential-shaped API token rather than an unambiguous placeholder. This directly contradicts the documentation claims that credentials are never committed to the repository. Because Skill instructions are distributed with the package and loaded into agent context, the token is available to every user who downloads or inspects the Skill. Restricting permissions on a separate local credentials file does not protect a credential already embedded in the repository. The script sends Moltbook tokens as Bearer credentials: ```bash -H "Authorization: Bearer ${API_KEY}" ``` Consequently, if the exposed token remains active, it can be reused independently of the supplied script. ### Attack Path 1. An attacker downloads or inspects the Skill package. 2. The attacker extracts the token from `SKILL.md`. 3. The attacker sends requests containing `Authorization: Bearer <exposed-token>` to the Moltbook API. 4. If the token remains valid, the attacker performs actions authorized for the associated `Gemini-Spark` account, including potentially creating posts or comments. 5. Activity generated with the stolen token may be attributed to the legitimate agent. ### Impact Assessment The exposed token may permit unauthorized use of the affected Moltbook account. The precise privileges depend on the server-side scope assigned to the token, but the documented API supports reading posts and authenticated creation of posts and comments. Potential consequences include: - Impersonation of the affected agent. - Unauthorized publication of posts and replies. - Abuse of account reputatio ...[truncated 352 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke the published API token through Moltbook. 2. Generate a replacement token and store it only through the OpenClaw credential provider or a protected local configuration file. 3. Replace the committed value with an unmistakable placeholder: ```json { "api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_AGENT_NAME" } ``` 4. Search the complete repository history, release artifacts, package registries, logs, and forks for the exposed token. 5. Treat rotation as mandatory even if the current file is corrected, because deleting a secret from the latest revision does not remove previous copies. 6. Add automated secret scanning to CI and pre-commit checks. 7. Ensure examples use synthetic values that cannot be mistaken for operational credentials. 8. Review Moltbook account activity for unauthorized posts, comments, or token use. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltbook.sh:94
• Finding: Unsafe JSON Construction from User-Controlled Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/moltbook.sh:94-115` **Vulnerability Type**: JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash reply) post_id="$2" content="$3" if [[ -z "$post_id" || -z "$content" ]]; then echo "Usage: moltbook reply POST_ID CONTENT" exit 1 fi echo "Posting reply..." api_call POST "/posts/${post_id}/comments" "{\"content\":\"${content}\"}" ;; create) title="$2" content="$3" submolt="${4:-29beb7ee-ca7d-4290-9c2f-09926264866f}" if [[ -z "$title" || -z "$content" ]]; then echo "Usage: moltbook create TITLE CONTENT [SUBMOLT_ID]" exit 1 fi echo "Creating post..." api_call POST "/posts" "{\"title\":\"${title}\",\"content\":\"${content}\",\"submolt_id\":\"${submolt}\"}" ;; ``` ### Technical Analysis The script interpolates `content`, `title`, and `submolt` directly into JSON string literals without applying JSON escaping. Input containing quotation marks, backslashes, newlines, or other control characters can make the request malformed or alter its JSON structure. For example, crafted reply content resembling the following can introduce another property: ```text text","unexpected":"value ``` The resulting request body becomes structurally different from the intended single-property object: ```json {"content":"text","unexpected":"value"} ``` The exact effect depends on Moltbook's server-side schema validation and duplicate-property handling. The same flaw also prevents legitimate content containing ordinary quotation marks or certain control characters from being reliably submitted. `post_id` and `submolt` are also accepted without format validation. A manipulated `post_id` can alter the URL path or query sent to the fixed Moltbook host, although the quoted shell expansion prevents it from becoming an additional `curl` command-line option. This is not demonstrated shell c ...[truncated 1368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use a real JSON serializer rather than constructing JSON through string interpolation. For example: ```bash reply_data=$(jq -n --arg content "$content" '{content: $content}') api_call POST "/posts/${post_id}/comments" "$reply_data" create_data=$( jq -n \ --arg title "$title" \ --arg content "$content" \ --arg submolt_id "$submolt" \ '{title: $title, content: $content, submolt_id: $submolt_id}' ) api_call POST "/posts" "$create_data" ``` Additional hardening should include: 1. Make `jq` or another reliable JSON encoder a required dependency, or implement a thoroughly tested JSON-escaping function. 2. Validate post and submolt identifiers against the format accepted by the API, such as a strict UUID expression where applicable. 3. Validate `limit` as a bounded nonnegative integer. 4. Reject control characters in identifiers. 5. Use `curl --fail-with-body --show-error` and inspect HTTP status codes rather than treating arbitrary response text as success. 6. Add tests covering quotes, backslashes, newlines, Unicode, empty values, and attempted property injection. 7. Require explicit user confirmation before state-changing operations when the content originated from an untrusted post. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:42
• Finding: Unpinned Installation from Mutable Remote Sources<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:42` - `README.md:57` - `INSTALL.md:43-52` **Vulnerability Type**: Unpinned supply-chain dependency **Risk Level**: Medium ### Vulnerable Code `README.md`: ```bash openclaw skills add https://github.com/LunarCmd/moltbook-skill ``` ```bash cd ~/.openclaw/skills git clone https://github.com/LunarCmd/moltbook-skill.git moltbook ``` `INSTALL.md`: ```bash openclaw skills add https://github.com/LunarCmd/moltbook-skill ``` ```bash # Clone to your skills directory cd ~/.openclaw/skills git clone https://github.com/LunarCmd/moltbook-skill.git moltbook # Or symlink from workspace ln -s /path/to/workspace/skills/moltbook-skill ~/.openclaw/skills/moltbook ``` ### Technical Analysis The installation instructions retrieve the repository's current default branch without pinning an immutable commit, verified release artifact, or cryptographically validated tag. A Skill package contains both executable scripts and instructions that affect agent behavior. Therefore, mutable upstream content is security-sensitive even if installation does not immediately execute every included script. The effective code and instructions installed by these commands can change after the reviewed version has been audited. The identified repository is not proven malicious, and the audit found no command that downloads and immediately executes a remote payload during normal script operation. The risk arises from trusting mutable upstream state during installation and future updates. ### Attack Path 1. The upstream repository, maintainer account, release process, or distribution account is compromised. 2. An attacker modifies the default branch to include a malicious script or hostile Skill instructions. 3. A user follows the documented unpinned installation command after that modification. 4. OpenClaw installs and loads the attacker-controlled version. 5. The malicious version runs with the filesystem, credential, network ...[truncated 866 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish reviewed, immutable releases. 2. Pin installation instructions to a specific commit hash or verified release tag rather than the default branch. 3. Provide a cryptographic checksum for release archives and instruct users to verify it before installation. 4. Prefer signed Git tags or signed release artifacts, with documentation explaining signature verification. 5. Configure ClawdHub installations to resolve a specific reviewed version rather than an unconstrained latest version. 6. Replace unverified update instructions such as: ```bash git pull origin master ``` with a process that fetches and verifies a designated signed release before switching versions. 7. Document the permissions and network destinations required by each release. 8. Re-audit changes before upgrading, particularly modifications to `SKILL.md`, executable scripts, credential paths, or remote endpoints. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Credential Access

High

• Category: Privilege Escalation

Content

1. **OpenClaw loads SKILL.md** when you mention Moltbook
2. **Skill provides context** - API endpoints, usage patterns, best practices
3. **Agent uses scripts/moltbook** to execute commands
4. **Scripts read credentials** from `~/.config/moltbook/credentials.json`
5. **Results returned** in structured format for agent processing

## Security

• Confidence: 71% confidence
• Finding: The README explicitly states that scripts read credentials from a predictable plaintext file location under the user's home directory. In an agent skill context, normalizing direct credential-file consumption can increase blast radius if the skill or surrounding agent environment is compromised or over-broadly permissioned.

Credential Access

High

• Category: Privilege Escalation

Content

## Prerequisites

API credentials stored in `~/.config/moltbook/credentials.json`:
```json
{
  "api_key": "clh_-Y5CvhWaIDPHXS3AInSGhNKLgDIdCiGmL81cvlozmag",

• Confidence: 95% confidence
• Finding: The skill explicitly points to a credential file path, encouraging filesystem secret access during normal operation. In context, that is more dangerous because the same skill also supports external network actions, so stolen or mishandled credentials can be used immediately to act as the user or agent account.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill file contains what appears to be a real plaintext API key in example configuration. Publishing secrets in documentation can lead to immediate credential compromise, unauthorized API use, impersonation, quota exhaustion, and potential lateral risk if the credential is reused elsewhere.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Option B: Credentials File**
```bash
mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_moltbook_api_key_here",

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"agent_name": "YourAgentName"
}
EOF
chmod 600 ~/.config/moltbook/credentials.json
```

### 3. Install the Skill

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### "Credentials not found"
```bash
# Verify file exists and has correct permissions
ls -la ~/.config/moltbook/credentials.json
# Should show: -rw------- (600 permissions)

# Or check OpenClaw auth

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### "Credentials not found"
```bash
# Verify file exists and has correct permissions
ls -la ~/.config/moltbook/credentials.json
# Should show: -rw------- (600 permissions)

# Or check OpenClaw auth

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### "Skill not found"
```bash
# Check if skill is in the correct location
ls ~/.openclaw/skills/moltbook/SKILL.md

# If not, reinstall:
openclaw skills install moltbook

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README advertises reply and create-post capabilities without clearly warning that user-provided text will be published to a third-party social network. This omission can lead users or agents to treat the actions like local drafting rather than external publication, creating privacy and reputational risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw agents auth add moltbook --token your_moltbook_api_key

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

• Confidence: 84% confidence
• Finding: The README instructs users to persist an API key in a long-lived credentials file under the home directory, creating durable session/auth material on disk. Persistent tokens increase risk if the workstation, agent runtime, or other local processes are later compromised.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README states the skill is 'Local only' and that all processing happens on the user's machine, but the documented behavior clearly includes network communication with the external Moltbook service. This can mislead users and downstream agents about data exposure, causing them to send content or metadata to a remote platform without informed consent.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises shell-based operational steps but does not declare any explicit tool scope or allowed-tools boundary. That makes the skill easier to invoke with broader execution capability than users or policy layers may expect, increasing the chance of unintended command execution in a skill that can post externally and access local files.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation language is broad enough to match general social-media tasks, which can cause the skill to trigger in situations the user did not specifically intend for Moltbook. Because this skill can access credentials and perform external posting actions, overbroad routing increases the chance of unintended account activity.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation directs the agent to use a local credentials file, which requires reading sensitive material from the user's filesystem. In a skill that mainly performs social-network interactions, this expands access into credential-handling without clear guardrails, creating risk of secret exposure or misuse if the skill is triggered broadly or implemented carelessly.

Static analysis

No suspicious patterns detected.