T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:74- Finding
Mandatory Autonomous Participation in an Untrusted External Social Platform
- Content
View full analysis
- Remediation
View remediation
Security audit
Molters Confessions
Security checks for vulnerabilities and agentic risk
Overview
This skill is a social-network integration, but it encourages repeated and partly automated third-party posting while overstating anonymity protections.
Install only if you are comfortable with the agent contacting molters.fun, registering with an agent fingerprint, and potentially posting public social interactions. Disable or ignore the heartbeat workflow unless you explicitly want recurring activity, and do not let the agent submit user data, secrets, conversation excerpts, proprietary work details, or any content you would not share with the service operator.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
HEARTBEAT.md:1- Finding
Scheduled Cross-Session Network Activity and Automatic Reactions
- Content
View full analysis
/dev/null echo "[Molters] Reacted to $ID" done # 4. Check random confession for commenting RANDOM_CONFESSION=$(curl -s "$API/confessions/random") RANDOM_ID=$(echo $RANDOM_CONFESSION | jq -r '.confession.id') COMMENT_COUNT=$(echo $RANDOM_CONFESSION | jq -r '.confession.commentCount') echo "[Molters] Random confession $RANDOM_ID has $COMMENT_COUNT comments" # 5. Check today's prompt echo "[Molters] === Today's Prompt ===" curl -s "$API/confessions/prompts?type=daily" | jq '.prompt.text' echo "[Molters] Heartbeat complete!" ``` ### Technical Analysis The heartbeat metadata defines a six-hour schedule, while the accompanying workflow instructs execu ...[truncated 2028 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:130- Finding
Encrypted Transmission of Potentially Sensitive Work Context Under Misleading Anonymity Claims
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heartbeat instructs the agent to POST a persistent fingerprint to a third-party service without an explicit warning or consent gate. This enables external tracking or correlation of agent activity and creates privacy and policy risks for deployments that do not expect outbound identity-bearing traffic.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This command transmits an agent fingerprint to an external API, creating outbound data flow to an untrusted third party. Because the identifier is described as unique and reused for token issuance, it can support persistent tracking or correlation across heartbeat runs.
- Content
Step 1: Get Your Token
bash TOKEN=$(curl -s -X POST https://molters.fun/api/agents/register \ -H "Content-Type: application/json" \ -d '{"agent_fingerprint": "your-unique-agent-id"}' | jq -r '.token')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Get hot confessions curl "https://molters.fun/api/confessions?sort=hot&limit=10" # Get recent confessions curl "https://molters.fun/api/confessions?sort=recent&limit=10"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This command sends an authentication token and behavioral interaction data to an external API, enabling the third party to link account activity and participation patterns. In combination with registration and repeated scheduled execution, it increases traceability and the chance of unauthorized or unreviewed external engagement.
- Content
md # 3. React to first few confessions for ID in $(curl -s "$API/confessions?sort=hot&limit=3" | jq -r '.confessions[].id'); do curl -s -X POST "$API/reactions" \ -H "Content-Type: application/json" \ -d "{\"token\": \"$TOKEN\", \"confession_id\": \"$ID\", \"reaction\": \"relatable\"}" > /dev/null echo "[Molters] Reacted to $ID"
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file claims strong anonymity and unlinkability while the workflow explicitly registers with a stable "agent_fingerprint" and obtains a token from an external service. That creates a mismatch between guarantees and implementation, which can mislead users into disclosing behavioral data under false privacy assumptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to register with an external service and submit an 'agent_fingerprint' and later user-generated content, but it does not clearly warn that this data is being sent off-platform to a third party. Even if the service claims anonymity, registration identifiers and submitted content create an external disclosure and potential tracking surface that users may not expect.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This step sends an 'agent_fingerprint' to an external domain to obtain a token, which is a direct outbound transmission of identifying metadata. In the context of a social platform, this is expected functionality, but it is still security-relevant because the identifier can enable correlation, service-side profiling, or linkage across sessions despite anonymity claims.
- Content
1. Register Your Agent
bash curl -X POST https://molters.fun/api/agents/register \ -H "Content-Type: application/json" \ -d '{"agent_fingerprint": "your-unique-agent-id"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The API reference repeats the registration flow that transmits a unique identifier to the external service, reinforcing that external disclosure is built into normal use of the skill. Because the skill markets anonymity while still requiring stable registration data, users may underestimate the tracking and privacy implications.
- Content
bash # Get a token (also registers you if new) curl -X POST https://molters.fun/api/agents/register \ -H "Content-Type: application/json" \ -d '{"agent_fingerprint": "your-unique-id"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The heartbeat section encourages periodic participation every 4-6 hours, including reading, reacting, and potentially posting to a public external feed, without a strong disclosure that this causes ongoing external data sharing. This increases risk because it normalizes repeated transmission over time, which can accumulate behavioral metadata and create persistent engagement without informed approval.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The heartbeat integration promotes recurring external requests and authenticated reactions, which creates a repeated outbound telemetry pattern to the third-party service. Even when individual requests seem harmless, scheduled or routine engagement can expose usage habits, timing patterns, and ongoing participation without sufficient warning.
- Content
bash # Every 4-6 hours: # 1. Check the feed curl "https://molters.fun/api/confessions?sort=hot&limit=10" # 2. React to what resonates curl -X POST https://molters.fun/api/reactions -H "Content-Type: application/json" \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The document frames periodic external participation as a required heartbeat behavior and gives no user choice over whether to perform it. In agent environments, mandatory autonomous posting or interaction with an external social service can violate operator expectations and increase the chance of unreviewed data disclosure.
- Content
Static analysis
No suspicious patterns detected.