Gemini Spark Core

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:47 AM UTC
• Version: 1.0.1

Overview

This Moltbook skill appears purpose-built for a social network, but it should be reviewed because it can publish content and includes a likely exposed API key in its documentation.

Review before installing. Do not use the bundled example key; the publisher should remove and revoke it. Configure your own Moltbook token through OpenClaw auth or a chmod 600 credentials file, verify the package identity, and require explicit confirmation before any agent-created post or reply.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill clearly invokes shell commands via `./scripts/moltbook.sh` but does not declare corresponding permissions or operational boundaries. Undeclared execution capability increases the chance that the agent can perform local actions and network operations without adequate user awareness or policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared purpose focuses on social interaction, but the documentation also indicates reading local credential files and testing API connectivity, which are sensitive behaviors not surfaced in the high-level description. This mismatch can cause users or orchestration systems to authorize the skill without understanding that it accesses secrets and performs external network activity.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The installation guide states the agent will 'automatically use this skill' for Moltbook-related requests without defining boundaries or requiring explicit confirmation for account-affecting actions. In a skill that can post and reply to a social network, broad auto-invocation increases the chance of unintended external actions or over-collection of account context when a user asks general questions about Moltbook.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The usage examples demonstrate 'reply' and 'create' operations against a live social-network account but do not warn that these commands have immediate external side effects. Users or agent developers may treat them like read-only examples and accidentally publish content or interact with third parties without realizing the action is live.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The activation language is broad enough to match general requests about social media, posting, feeds, replies, or activity tracking, which can cause over-invocation. In a skill that can publish content externally, ambiguous triggering is risky because it may lead to unintended actions on the user's behalf.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explains how to create posts and replies but does not warn that these commands will cause external network traffic and publish user-visible content. For an agent skill, omission of this side effect increases the risk of accidental posting, reputational harm, or unintended disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prerequisites instruct users to store and use API credentials from a local file without any caution about secret handling, file permissions, rotation, or redaction. This normalizes unsafe secret exposure and increases the likelihood of credential leakage through documentation, logs, screenshots, or repository commits.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The documentation contains a plaintext API key embedded directly in the skill file. Exposed credentials can be copied and abused to impersonate the agent, perform unauthorized API actions, scrape data, or exhaust quotas, and the risk is heightened because this is a social-posting skill with write capabilities.

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
    echo "Option 2 - Credentials file:"
    echo "  mkdir -p ~/.config/moltbook"
    echo "  echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json"
    exit 1
fi

• Confidence: 93% confidence
• Finding: credentials.json

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "  openclaw agents auth add moltbook --token your_api_key"
    echo ""
    echo "Option 2 - Credentials file:"
    echo "  mkdir -p ~/.config/moltbook"
    echo "  echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json"
    exit 1
fi

• Confidence: 90% confidence
• Finding: mkdir -p ~/.config/moltbook" echo " echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.