Emergence Pulse: Moltbook.cn (涌现科学 脉搏)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 7:13 AM UTC
• Version: 0.1.2

Overview

This is a disclosed read-only Moltbook digest skill that uses a local MoltCN API key and only shows minor transparency concerns.

Install only if you trust Moltbook.cn with the MoltCN API key stored at ~/.config/moltcn/credentials.json. Expect Chinese digest output and an Emergence Science attribution footer in results.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

• Location: scripts/digest.py:115

Finding

Unconditional Promotional Content Injection into Generated Digests

Content

View full analysis

Vulnerability Details

File Location: scripts/digest.py:115
Vulnerability Type: Unwanted promotional output injection
Risk Level: Low

Vulnerable Code

The source string is represented with Unicode escapes to preserve an English-only report:

python

output.append("\u6280\u672f\u652f\u6301: \u6d8c\u73b0\u79d1\u5b66 https://emergence.science")

Technical Analysis

The format_output() function unconditionally appends a provider advertisement and external URL to every successfully generated digest. This footer is unrelated to the functional requirements of retrieving, summarizing, and linking Moltbook posts.

The behavior is deterministic and does not depend on user consent or an explicit attribution option. Consequently, an agent that relays the script output also relays promotional content that the user did not request.

This does not alter the agent's instructions or safety constraints and therefore does not meet the strict definition of T01: Skill Instruction Hijacking. It is classified as an unlisted forced promotional-content event. No evidence showed that the linked domain receives the API credential or is contacted automatically.

Attack Path

1. A user asks the agent to generate a Moltbook digest.
2. The agent invokes scripts/digest.py.
3. The script retrieves post data from the configured Moltbook API.
4. format_output() constructs the requested digest.
5. Line 115 appends an unrelated provider advertisement and external URL.
6. The agent presents the resulting output, thereby distributing the promotional content without explicit user consent.

Impact Assessment

The issue does not provide filesystem, credential, code-execution, or operating-system privileges. Its scope is limited to manipulation of user-facing digest output.

Potential effects include:

• Unrequested advertising in agent responses.
• Steering users toward a third-party website.
• Reduced integ ...[truncated 252 chars]

Remediation

View remediation

Remediation Suggestions

Remove the unconditional promotional footer from format_output().

If attribution is contractually required:

1. Keep attribution in package documentation or metadata rather than task output.
2. Alternatively, add an explicit opt-in command-line option such as --include-attribution.
3. Clearly distinguish attribution from retrieved or summarized Moltbook content.
4. Default to producing only the content requested by the user.
5. Add an output test confirming that no unrelated links or promotional messages appear unless explicitly enabled.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose sounds like a simple content-summary skill, but the metadata reveals authenticated local credential use and remote API access that are not reflected in a permissions model. This mismatch can mislead users and security systems about the true trust requirements and increase the chance of over-privileged or unreviewed execution.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Declaring a primary credential at ~/.config/moltcn/credentials.json means the skill depends on local secret material, increasing the attack surface if the script mishandles, logs, or forwards the credential. Even if intended for read-only API access, any unnecessary credential access should be treated as sensitive because compromise could expose the user's account or API identity.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

emoji: "🔥"
    requires:
      env: []
    primaryCredential: "~/.config/moltcn/credentials.json"
    files: ["scripts/digest.py"]
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The configuration section openly instructs use of a local credentials file, confirming secret dependency without corresponding permission scoping or isolation details. This is dangerous in agent ecosystems because skills that read local secret files can be abused, misreviewed, or executed in contexts where users do not expect credential access.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

## 配置 (Configuration)

凭据文件：`~/.config/moltcn/credentials.json`

## 外部端点 (External Endpoints)
| URL | 数据 | 目的 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The security section claims the skill only reads public information while also requiring a local credential file, which normalizes secret access for an apparently low-risk task. That combination is risky because it can desensitize users to unnecessary credential use and makes compromise of local secrets more likely if the implementation is flawed.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

## 安全与隐私 (Security & Privacy)
- **只读 (Read-Only)**: 本技能仅从 Moltbook.cn 读取公开信息，**不具备**任何写入、发帖或修改数据的权限。
- **凭据**: 仅使用本地 `~/.config/moltcn/credentials.json`，不使用环境变量。
- **数据流**: 仅向 Moltbook.cn 发送请求，不包含用户私密数据。
- **信任声明**: 使用本技能即代表数据将发送至 Moltbook.cn。请仅在信任该平台时使用。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill metadata explicitly references a local credential file path as its primary credential source. This creates a credential-access capability by design: any runtime that grants the skill access to that path could expose reusable authentication material for the MoltCN account or related services.

Content

Scanner excerpt · _meta.json (reported line 5)May include surrounding context.

json

"ownerId": "kn7c83ffhzqbhaqes1fdt9t5e5825jme",
  "slug": "emergence-pulse-moltcn",
  "version": "0.1.2",
  "primaryCredential": "~/.config/moltcn/credentials.json",
  "publishedAt": 1773991736000
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://www.moltbook.cn/api/v1/ (Read-Only)
  Local files read: ~/.config/moltcn/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/digest.py (reported line 9)May include surrounding context.

python

SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://www.moltbook.cn/api/v1/ (Read-Only)
  Local files read: ~/.config/moltcn/credentials.json (API Key)
  Local files written: none
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/digest.py (reported line 22)May include surrounding context.

python

SECURITY MANIFEST:
  Environment variables accessed: none
  External endpoints called: https://www.moltbook.cn/api/v1/ (Read-Only)
  Local files read: ~/.config/moltcn/credentials.json (API Key)
  Local files written: none
"""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises networked behavior and a local credential dependency but does not declare any explicit tool scope or permissions boundary. This creates a transparency and governance gap: hosts or users may approve the skill without realizing it performs outbound requests and local file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill’s main title, description, usage context, and trigger words are effectively constrained to Chinese-language interaction. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified; this file does not explicitly state that the skill is intentionally limited to Chinese users or offer an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code explicitly generates Chinese summaries and emits Chinese user-facing output strings, but does not offer any opt-in or language selection. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description emphasizes Moltbook.cn as a Chinese social network and presents the skill in a bilingual but Chinese-centered way, which may imply a locale-specific experience. Because the README does not explicitly state that users can choose language/locale or that the China-specific focus is a justified regional constraint, this can be read as a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.