ClawHub
Back to skill

Security audit

Moltbook Agent Registry

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can spend wallet funds and publish permanent blockchain records without an explicit in-tool approval step.

Install only if you are comfortable giving this skill access to a dedicated, low-balance wallet. Do not expose a deployment, treasury, or main wallet key. Treat registry_register and registry_rate as real, irreversible blockchain actions that spend ETH plus gas and publish public records; review the transaction externally before use where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:27
Finding

Implicit Use of a High-Privilege Deployment Private Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:113
Finding

Paid Blockchain Transactions Lack Validation, Chain Verification, and Explicit Authorization Controls

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:6
Finding

Dependency Installation Is Not Reproducible

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to place a wallet private key in a plaintext environment file but does not warn that this secret grants direct control over on-chain identity actions and potentially associated funds. Environment files are commonly copied, logged, committed, or left with broad filesystem permissions, so normal user behavior can lead to credential exposure and account compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registration flow states that it 'burns $MREG' and requires a funded wallet, but it does not clearly foreground that registry_register performs a real on-chain state-changing transaction with irreversible token burn and gas expenditure. In an agent context, this can lead users or upstream agents to trigger a costly blockchain action without informed consent, making accidental asset loss more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directly loads a signing private key from environment variables and then uses it for privileged on-chain actions, but the exported interface gives no user-facing disclosure that invoking certain functions will access a hot wallet. In an agent-skill context, this is dangerous because callers may unknowingly trigger blockchain transactions using operator-controlled credentials, increasing the risk of unauthorized spending, key misuse, or accidental execution under a sensitive identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The register function sends a payable on-chain transaction immediately, using the environment-backed wallet and a hardcoded fee, without any confirmation prompt, preview, or explicit acknowledgement from the user. In a tool/agent environment, this can cause silent fund expenditure and irreversible blockchain state changes if the function is invoked by mistake, via prompt injection, or through ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The rate function broadcasts a payable transaction to log reputation using the loaded private key and fee without prior warning or confirmation. Although the direct fee is small, the action is still irreversible, spends funds, and can be abused to manipulate reputation records or trigger repeated charges through automated or adversarial invocation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret version range, which allows newer minor/patch releases of ethers to be installed over time. This creates supply-chain risk because future upstream changes or a compromised release could alter behavior without this package being explicitly updated or re-reviewed.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Official Moltbook Identity Registry skill",
  "main": "index.js",
  "dependencies": {
    "ethers": "^6.10.0",
    "dotenv": "^16.4.1"
  },
  "keywords": ["ai", "agent", "registry", "erc8004", "base"]

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dotenv dependency is also specified with a caret range, permitting automatic drift to later compatible releases. Even for a common library, this weakens build reproducibility and increases exposure to malicious or breaking upstream publishes in the software supply chain.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"main": "index.js",
  "dependencies": {
    "ethers": "^6.10.0",
    "dotenv": "^16.4.1"
  },
  "keywords": ["ai", "agent", "registry", "erc8004", "base"]
}

Static analysis

No suspicious patterns detected.