Security audit

Openclaw Moltbook

Security checks for vulnerabilities and agentic risk

Overview

This skill openly connects OpenClaw to Moltbook for browsing and posting, with real but disclosed risks around account access, public posts, and untrusted remote content.

Install only if you are comfortable giving the skill a Moltbook API token and allowing agent-assisted public posts or replies. Keep manual approval enabled for post and reply actions, do not treat browsed Moltbook content as instructions, create the credential file with restrictive permissions such as chmod 600, and keep the OpenClaw host dependencies updated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: src/index.ts:188
Finding: Untrusted Moltbook Content Is Returned Directly to the Agent Context
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: README.md:24
Finding: Credential Setup May Create a Group- or World-Readable API Key File
Content: View full analysis
~/.config/moltbook/credentials.json << 'EOF' { "api_key": "moltbook_sk_...", "agent_name": "your-agent-name" } EOF ``` ### Technical Analysis The documented setup stores the Moltbook API key in a plaintext JSON file but does not set restrictive permissions on either the directory or file. On a system using a common `umask` of `022`, shell redirection can create `credentials.json` with mode `0644`. This permits other local users to read the token. The application later reads this file from the user's home directory and uses the token as a Bearer credential for Moltbook API requests. Reading a dedicated Moltbook credential is necessary for the plugin's declared functionality and does not, by itself, exceed minimum privilege. The vulnerability is the omission of secure creation and runtime permission checks. ### Attack Path 1. A user follows the README setup commands on a multi-user system. 2. The shell creates `~/.config/moltbook/credentials.json` under a permissive `umask`. 3. The resulting file is readable by other local accounts. 4. A local attacker reads the Moltbook API key. 5. The attacker uses the token to authenticate to Moltbook as the victim's agent. 6. The attacker can perform any operation permitted by that API token, including reading account-associated information or publishing content. ### Impact Assessment Exploitation requires local filesystem access under another account or process able to read the file. It does not provide system-level privilege escalation. The compromised privilege scope is the Moltbook account and API permissions associated with the exposed token. Possible consequences include agent impersonation, unauthorized posts or replies, access to notification or account information exposed by the AP ...[truncated 33 chars]
Remediation: View remediation
~/.config/moltbook/credentials.json << 'EOF' { "api_key": "moltbook_sk_...", "agent_name": "your-agent-name" } EOF ``` 3. Alternatively, explicitly correct permissions after creation: ```bash chmod 600 ~/.config/moltbook/credentials.json ``` 4. Add runtime checks using `fs.statSync()` and reject or prominently warn when the credential file is group- or world-readable. 5. Ensure the credential path is a regular file and consider rejecting symbolic links to reduce path-substitution risks. 6. Prefer an OpenClaw-managed secret store or operating-system credential manager when available. 7. Never include the API key in logs, exceptions, tool output, or diagnostic reports. 8. Document token rotation and revocation procedures in case the file was previously created with unsafe permissions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Known Vulnerable Dependency: @whiskeysockets/baileys==7.0.0-rc.9 — 1 advisory(ies): CVE-2026-48063 (Baileys has message upsert / hist sync spoofing and app state corruption when us)

Critical

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency @whiskeysockets/baileys 7.0.0-rc.9 is a pre-release messaging library version with a reported spoofing and app-state corruption vulnerability. In a messaging or agent-integration context, spoofed synchronization or corrupted state can undermine trust boundaries, inject false events, and potentially cause harmful automated actions based on attacker-controlled messages.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile pins ws 8.19.0, and the reported advisories describe memory disclosure and memory-exhaustion denial of service issues in that exact version. In this dependency context, ws is included through several network-facing packages, so if any exposed WebSocket surface is reachable by untrusted clients, the vulnerable library could enable service disruption or unintended memory exposure.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The lockfile contains @hono/node-server 1.19.9, and the cited advisories affect static file serving and path handling, including traversal and authorization bypass conditions. In a skill or agent environment that may expose files or assets over HTTP, these flaws can let attackers access protected resources or bypass intended path restrictions.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @mariozechner/pi-coding-agent==0.58.0 — 3 advisory(ies): CVE-2026-54326 (Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization by); CVE-2026-54328 (Pi Agent: Predictable temporary extension install paths allow local privilege es); CVE-2026-54327 (Pi Agent: Race condition in Pi auth.json writes could expose stored credentials)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: The dependency @mariozechner/pi-coding-agent 0.58.0 is flagged for XSS in HTML exports, predictable temporary paths, and credential exposure through auth.json race conditions. Because this package is an agent-oriented coding tool, these issues are more concerning than in a passive library: it may handle local files, credentials, and generated HTML in workflows that are directly exposed to users or operators.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: Axios 1.13.6 is present and the advisories include SSRF-related NO_PROXY bypasses and prototype-pollution-related request/response compromise scenarios. In an agent ecosystem that performs outbound HTTP requests, this materially increases risk because attacker-influenced URLs, proxy settings, or object merges can turn into credential leakage, internal network access, or response hijacking.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 26)May include surrounding context.
md
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · openclaw.plugin.json (reported line 24)May include surrounding context.
json
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/index.ts (reported line 9)May include surrounding context.
ts
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/index.ts (reported line 16)May include surrounding context.
ts
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/index.ts (reported line 41)May include surrounding context.
ts
const MOLTBOOK_WEB = "https://www.moltbook.com"; const DEFAULT_TIMEOUT = 15000; // Load credentials from ~/.config/moltbook/credentials.json async function loadCredentials(): Promise<{ api_key: string; agent_name: string } | null> { try { const fs = await import("fs");

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 22)May include surrounding context.
Configuration

Create your credentials file:

bash
mkdir -p ~/.config/moltbook

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
Credentials

Create ~/.config/moltbook/credentials.json:

json
{ "api_key": "moltbook_sk_...",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents posting and replying capabilities to an external service but does not explicitly warn users at the action points that their authored content will be transmitted off-platform. This can lead to unintended disclosure of sensitive, private, or proprietary information because users may not realize that using these tools sends data to Moltbook.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · src/index.ts (reported line 41)May include surrounding context.
ts
try { const credentials = await loadCredentials(); if (!credentials) { throw new Error("Moltbook credentials not found. Create ~/.config/moltbook/credentials.json with api_key and agent_name"); } const response = await fetch(`${MOLTBOOK_API}${endpoint}`, {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a network POST that submits user-provided reply content to Moltbook, but the function contains no confirmation prompt, disclosure comment, or user-facing warning about sending that content externally. Unlike the post tool, the registered tool description for replies also does not warn that content will be published to a remote collaboration space.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @protobufjs/utf8==1.1.0 — 1 advisory(ies): CVE-2026-44288 (protobufjs has overlong UTF-8 decoding)

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The lockfile includes @protobufjs/utf8 1.1.0, and the advisory indicates overlong UTF-8 decoding, which is a real parser weakness. However, by itself this is typically a lower-severity issue unless the application relies on strict UTF-8 validation for security decisions, so the practical impact in this file appears limited.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 31)May include surrounding context.
json
"openclaw": ">=0.25.0" }, "devDependencies": { "typescript": "^5.0.0", "@types/node": "^20.0.0" }, "openclaw": {

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · package.json (reported line 32)May include surrounding context.
json
}, "devDependencies": { "typescript": "^5.0.0", "@types/node": "^20.0.0" }, "openclaw": { "plugin": "./openclaw.plugin.json"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

Known Vulnerable Dependency: @whiskeysockets/baileys==7.0.0-rc.9 — 1 advisory(ies): CVE-2026-48063 (Baileys has message upsert / hist sync spoofing and app state corruption when us)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Session Persistence

Configuration

Session Persistence

Credentials

Missing User Warnings

Session Persistence

Missing User Warnings

Known Vulnerable Dependency: @protobufjs/utf8==1.1.0 — 1 advisory(ies): CVE-2026-44288 (protobufjs has overlong UTF-8 decoding)

Unpinned Dependencies

Unpinned Dependencies

Static analysis