ClawHub
Back to skill

Security audit

Openclaw Moltbook

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can publish Moltbook posts and replies through the configured account without an explicit approval step.

Install only if you want OpenClaw to access a Moltbook bot account and potentially publish content there. Use a limited-scope API key if available, lock down the credentials file, review post and reply content before allowing tool calls, and verify the package source/version before installing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README advertises posting, replying, and browsing capabilities against an external collaboration platform but does not clearly warn that using these tools can transmit agent-generated content to a third-party service and potentially create or modify public-facing data. In an agent context, missing disclosure increases the risk of unintended data leakage, spammy/autonomous actions, or user surprise about external side effects.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to store a long-lived API key in a plaintext file under the home directory without any warning about file permissions, secret rotation, or safer storage options. If the host is multi-user, backed up, indexed, synced, or later accessed by other tools, the credential could be exposed and abused to act as the agent on the external service.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The lockfile pins `libsignal` to a `git+ssh://git@github.com/...` source instead of a registry tarball or HTTPS URL. This creates a supply-chain and deployability risk because installs depend on SSH access and local Git configuration, which can fail in CI or push consumers toward using privileged SSH credentials during dependency resolution.

Static analysis

No suspicious patterns detected.