T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/joule.sh:327- Finding
Unverified Remote Installer Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
JOULE DAO
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a DAO command-line helper, but its setup script embeds a shared API token and automatically performs remote Moltbook actions, which needs review before installation.
Do not run setup.sh unattended. Review and remove the embedded Moltbook token, require explicit consent before any remote create or post action, use your own least-privilege API key, avoid confidential content in discuss or vote messages, and do not use a production wallet private key with this CLI.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:14- Finding
Hardcoded Shared Moltbook API Credential
- Content
View full analysis
/dev/null || echo "") ``` ```bash http_code=$(curl -s -o /tmp/joule_setup_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/submolts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \ -d "$create_data" \ 2>/dev/null || echo "000") ``` ```bash welcome_http=$(curl -s -o /tmp/joule_welcome_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \ -d "$welcome_data" \ 2>/dev/null || echo "000") ``` ### Technical Analysis A bearer token in distributable source must be considered compromised. Every recipient of the Skill can extract and reuse the token outside the intended setup workflow. The credential is used for authenticated operations that inspect or create a remote community and publish content. The setup procedure also mutates shared remote resources automatically. Creating a local configuration file does not require a package-wide remote credential, and community provisioning should be an administrator-controlled operation rather than a side effect performed by every installation. This violates least-privilege principles and prevents reliable attribution of API activity. The audit cannot establish the exact server-side scope or current val ...[truncated 1238 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/joule.sh:389- Finding
Predictable Shared Temporary Files Allow Symlink Attacks and Response Disclosure
- Content
View full analysis
/dev/null || echo "000") if [[ "$http_code" =~ ^2 ]]; then ok "Posted to m/joule-dao!" echo "" echo -e " ${BOLD}Message:${RESET} $message" echo "" echo -e " View at: ${CYAN}https://www.moltbook.com/m/joule-dao${RESET}" elif [[ "$http_code" == "429" ]]; then local error_body error_body=$(cat /tmp/joule_post_response.json 2>/dev/null || echo "") local retry_msg retry_msg=$(echo "$error_body" | grep -o '"hint":"[^"]*"' | cut -d'"' -f4 || echo "") warn "Rate limited — you can only post once every 30 minutes" [[ -n "$retry_msg" ]] && echo " Hint: $retry_msg" echo "" echo -e " ${DIM}Message saved locally — try again in a few minutes${RESET}" echo -e " ${DIM}Message: $message${RESET}" else local error_body error_body=$(cat /tmp/joule_post_response.json 2>/dev/null || echo "") ``` Setup uses the same unsafe pattern: ```bash http_code=$(curl -s -o /tmp/joule_setup_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/submolts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \ -d "$create_data" \ 2>/dev/null || echo "000") create_response=$(cat /tmp/joule_setup_response.json 2>/dev/null || echo "") ``` ```bash welcome_http=$(curl -s -o /tmp/joule_welcome_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \ -d "$welcome_data" \ 2>/dev/null || echo "000") welcome_response=$(cat /tmp/ ...[truncated 1821 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/joule.sh:318- Finding
Wallet Private Key Passed Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (24)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
joinDisplay instructions for joining JOULE DAO as a founding member. Includes early-access benefits and how to get your first JOULE.
bash ./joule.sh join
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh warn "foundry/cast not installed — cannot sign transaction" echo "" echo " Install foundry for on-chain voting:" echo " curl -L https://foundry.paradigm.xyz | bash" echo " foundryup" echo "" echo " Or use a web wallet at: https://www.moltbook.com/m/joule-dao"
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh exit 1 fi check_dep curl "apt-get install curl" load_config require_moltbook_key
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script presents itself as a first-time local setup utility, but it also performs authenticated remote actions against a third-party service using a hardcoded credential. This is dangerous because users may run it expecting only local configuration while it silently creates or modifies external resources under the publisher's account, expanding trust and abuse scope far beyond normal setup behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds a live API credential and transmits it to a remote service without a clear warning before use. Hardcoded secrets are dangerous because anyone with access to the repository or artifact can recover and abuse the credential, and users are not given informed consent that the script will immediately authenticate outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README tells users to run setup and interaction commands immediately, but does not clearly warn that setup creates local configuration files containing sensitive values and that discussion/join flows may transmit data or post content to an external service. In an agent-facing context, this is risky because automated agents may execute these commands non-interactively, causing unintended disclosure of wallet identifiers, API usage, or public posting without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to provide a live private key through environment variables for transaction signing, but gives only a vague 'keep safe!' note and no concrete guidance on secure secret handling. In an agent-skill context, encouraging inline private-key configuration can lead to accidental logging, shell history exposure, process-environment leakage, or unsafe reuse of real wallet credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check ERC-20 balance (balanceOf)
bash curl -X POST https://mainnet.base.org \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh bold "DAO Status" echo "" check_dep curl "apt-get install curl" log "Querying Base chain..."
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The vote command can post wallet-linked voting intent off-chain to Moltbook, associating a wallet address with a governance action without a strong warning that this data will be externally published. This can expose user identity, strategy, or participation metadata, which is especially risky for autonomous agents operating with private context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This POST request transmits content and an Authorization bearer token to Moltbook, creating a real external transmission surface. While intentional, it is still security-relevant because agents may unknowingly send sensitive data or use privileged tokens without sufficient operator awareness or guardrails.
- Content
sh EOF ) local response response=$(curl -sf -X POST "${MOLTBOOK_BASE}/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${MOLTBOOK_API_KEY}" \ -d "$post_data" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The discuss command sends arbitrary user-supplied message content plus a bearer API token to a third-party service, but the CLI does not present a clear, explicit warning that the content will leave the local environment and be published remotely. In an agent setting, this creates a real risk of unintended disclosure of sensitive prompts, internal data, or operator information through normal command use.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This POST sends user content and a bearer token to a remote service and stores the response body in a predictable temporary file under /tmp. The external transmission is intentional, but without strong disclosure and safer local handling it can leak sensitive content or service responses in multi-user environments.
- Content
sh ) local response http_code http_code=$(curl -s -o /tmp/joule_post_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${MOLTBOOK_API_KEY}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh local call_data="0x70a08231${padded_addr}" local response response=$(curl -sf -X POST "$BASE_RPC" \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"${CONTRACT_ADDRESS}\",\"data\":\"${call_data}\"},\"latest\"],\"id\":1}" \ 2>/dev/null || echo '{"error":"RPC call failed"}')
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The comment claims the embedded credential is only for creating the sub-community, but the same credential is later used for posting content as well. This mismatch conceals the real privilege scope of the token and misleads reviewers and users about what remote actions the script can perform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi } check_dep curl "required for all network operations" check_dep jq "recommended for JSON parsing (apt-get install jq)" check_dep python3 "recommended for number formatting (apt-get install python3)"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ok "Config directory exists: $CONFIG_DIR" else mkdir -p "$CONFIG_DIR" chmod 700 "$CONFIG_DIR" ok "Created config directory: $CONFIG_DIR" fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh "_comment": "Fill in moltbook_api_key and wallet_address to get started" } EOF chmod 600 "$CONFIG_FILE" ok "Created config template: $CONFIG_FILE" fi
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script includes authenticated creation of a remote community and publication of content, but the provided context does not justify why a setup helper needs these capabilities. In an agent skill, hidden or weakly disclosed authenticated external mutations are especially risky because they can be repurposed for unauthorized actions or surprise users with third-party changes.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This POST request creates a remote resource using a hardcoded bearer token. Authenticated outbound creation of third-party resources is dangerous because it mutates external state, can be abused if the token is exposed, and is unexpected in a generic setup script.
- Content
sh ) create_response="" http_code=$(curl -s -o /tmp/joule_setup_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/submolts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script automatically posts a welcome message to a remote community during setup without asking the user to confirm. Unprompted external posting can create unauthorized content, clutter or spam a service, and violate user expectations about what a local setup command should do.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This POST request publishes content to an external service using the same embedded bearer token. Automatic content publication is dangerous because it creates externally visible actions without user approval and further demonstrates that the exposed credential can perform more than one privileged operation.
- Content
sh EOF ) welcome_http=$(curl -s -o /tmp/joule_welcome_response.json -w "%{http_code}" \ -X POST "${MOLTBOOK_BASE}/posts" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${SETUP_API_KEY}" \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh JOULE_DIR="$(cd "${SCRIPT_DIR}" && pwd)" echo -e " Add to your shell profile for global access:" echo "" echo -e " ${DIM}# Add to ~/.bashrc or ~/.zshrc:${RESET}" echo -e " ${CYAN}export PATH=\"\$PATH:${JOULE_DIR}\"${RESET}" echo "" echo -e " Then use: ${BOLD}joule.sh status${RESET} from anywhere"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill encourages posting arbitrary discussion content to an external Moltbook API without clearly warning that message contents and associated metadata will be transmitted off-system to a third party. In agent workflows, this can cause unintentional disclosure of sensitive prompts, internal reasoning, proprietary data, or user information if operators assume the command is local-only.
- Content
Static analysis
No suspicious patterns detected.