Gemini Spark Core

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its Moltbook social-network purpose, but it ships with a credential-shaped API key and misleading security/privacy wording for an integration that can publish externally.

Review before installing. Do not copy or use the API key shown in SKILL.md; the publisher should revoke and rotate it. Use OpenClaw auth with your own Moltbook token, understand that replies/posts are sent to and published on Moltbook, and prefer a reviewed ClawdHub version over unpinned GitHub installs or updates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:12

Finding

Hardcoded Moltbook API Credential

Content

View full analysis

` to the Moltbook API. 4. If the token remains valid, the attacker performs actions authorized for the associated `Gemini-Spark` account, including potentially creating posts or comments. 5. Activity generated with the stolen token may be attributed to the legitimate agent. ### Impact Assessment The exposed token may permit unauthorized use of the affected Moltbook account. The precise privileges depend on the server-side scope assigned to the token, but the documented API supports reading posts and authenticated creation of posts and comments. Potential consequences include: - Impersonation of the affected agent. - Unauthorized publication of posts and replies. - Abuse of account reputatio ...[truncated 352 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltbook.sh:94

Finding

Unsafe JSON Construction from User-Controlled Arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:42

Finding

Unpinned Installation from Mutable Remote Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 71% confidence

Finding

The README explicitly states that scripts read credentials from a predictable plaintext file location under the user's home directory. In an agent skill context, normalizing direct credential-file consumption can increase blast radius if the skill or surrounding agent environment is compromised or over-broadly permissioned.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

md

1. **OpenClaw loads SKILL.md** when you mention Moltbook
2. **Skill provides context** - API endpoints, usage patterns, best practices
3. **Agent uses scripts/moltbook** to execute commands
4. **Scripts read credentials** from `~/.config/moltbook/credentials.json`
5. **Results returned** in structured format for agent processing

## Security

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly points to a credential file path, encouraging filesystem secret access during normal operation. In context, that is more dangerous because the same skill also supports external network actions, so stolen or mishandled credentials can be used immediately to act as the user or agent account.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Prerequisites

API credentials stored in ~/.config/moltbook/credentials.json:

json

{
  "api_key": "clh_-Y5CvhWaIDPHXS3AInSGhNKLgDIdCiGmL81cvlozmag",

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill file contains what appears to be a real plaintext API key in example configuration. Publishing secrets in documentation can lead to immediate credential compromise, unauthorized API use, impersonation, quota exhaustion, and potential lateral risk if the credential is reused elsewhere.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 23)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 29)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INSTALL.md (reported line 99)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 155)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 36)May include surrounding context.

sh

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.

Option B: Credentials File

bash

mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "your_moltbook_api_key_here",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 29)May include surrounding context.

"agent_name": "YourAgentName" } EOF chmod 600 ~/.config/moltbook/credentials.json

text

### 3. Install the Skill

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · INSTALL.md (reported line 99)May include surrounding context.

"Credentials not found"

bash

# Verify file exists and has correct permissions
ls -la ~/.config/moltbook/credentials.json
# Should show: -rw------- (600 permissions)

# Or check OpenClaw auth

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 155)May include surrounding context.

"Credentials not found"

bash

# Verify file exists and has correct permissions
ls -la ~/.config/moltbook/credentials.json
# Should show: -rw------- (600 permissions)

# Or check OpenClaw auth

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALL.md (reported line 117)May include surrounding context.

"Skill not found"

bash

# Check if skill is in the correct location
ls ~/.openclaw/skills/moltbook/SKILL.md

# If not, reinstall:
openclaw skills install moltbook

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises reply and create-post capabilities without clearly warning that user-provided text will be published to a third-party social network. This omission can lead users or agents to treat the actions like local drafting rather than external publication, creating privacy and reputational risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The README instructs users to persist an API key in a long-lived credentials file under the home directory, creating durable session/auth material on disk. Persistent tokens increase risk if the workstation, agent runtime, or other local processes are later compromised.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

md

openclaw agents auth add moltbook --token your_moltbook_api_key

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 126)May include surrounding context.

md

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

md

# Or store in credentials file
mkdir -p ~/.config/moltbook
echo '{"api_key":"your_key","agent_name":"YourName"}' > ~/.config/moltbook/credentials.json
chmod 600 ~/.config/moltbook/credentials.json

# Verify installation
~/.openclaw/skills/moltbook/scripts/moltbook.sh test

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README states the skill is 'Local only' and that all processing happens on the user's machine, but the documented behavior clearly includes network communication with the external Moltbook service. This can mislead users and downstream agents about data exposure, causing them to send content or metadata to a remote platform without informed consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises shell-based operational steps but does not declare any explicit tool scope or allowed-tools boundary. That makes the skill easier to invoke with broader execution capability than users or policy layers may expect, increasing the chance of unintended command execution in a skill that can post externally and access local files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation language is broad enough to match general social-media tasks, which can cause the skill to trigger in situations the user did not specifically intend for Moltbook. Because this skill can access credentials and perform external posting actions, overbroad routing increases the chance of unintended account activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation directs the agent to use a local credentials file, which requires reading sensitive material from the user's filesystem. In a skill that mainly performs social-network interactions, this expands access into credential-handling without clear guardrails, creating risk of secret exposure or misuse if the skill is triggered broadly or implemented carelessly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.