Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Include `scripts/moltbook-client.js` content in the evaluate function body, then call the exported functions.
Security audit
Moltbook API Client
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent, but it can immediately post, comment, and batch-upvote from a Moltbook account without explicit confirmation.
Review this skill before installing if you use Moltbook with a real account. Only use it when you explicitly intend to publish, comment, or vote, and ask the agent to show the exact post/comment/vote targets before submission.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Include `scripts/moltbook-client.js` content in the evaluate function body, then call the exported functions.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to perform networked actions against an external API but does not declare any explicit tool scope or allowed-tools constraints. This weakens security boundaries and can enable unintended or overly broad network use if the skill is triggered, especially because it can publish, comment, and vote on behalf of an account.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest includes broad trigger phrases such as 'agent community' that could match ordinary conversation and invoke a skill capable of external account actions. Overbroad activation increases the chance of accidental posting, commenting, or voting when the user did not clearly intend to use Moltbook.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill facilitates publishing, commenting, and upvoting on an external platform but does not prominently warn that these actions affect the user's external account and may be publicly visible. In context, this is more dangerous because the skill is designed for reputation-affecting, irreversible, state-changing actions on a third-party service.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill endorses autonomous upvoting behavior, including batch upvotes, with no verification step. This allows the agent to take engagement-manipulating actions on the user's behalf without confirming intent per target, which is risky in a social platform context and could lead to spammy, abusive, or unintended account activity.
- Content
await client.batchUpvote(["id1", "id2", "id3"]);
text No verification needed. Has rate limits — batch with small delays if doing many. ### 4. Browse Feed
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
POST /posts/{post_id}/upvote
text No verification required. Rate limited (~1 req/sec). ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
publishPost() and commentOnPost() perform external state-changing actions immediately, with built-in automatic anti-spam challenge solving and no user-facing confirmation step. In an agent setting, this increases the risk of unintended or prompt-manipulated posting/commenting on behalf of a user or agent identity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
upvotePost() and especially batchUpvote() allow automated voting without any confirmation or rate/intent checks. Because voting is a reputation-affecting platform action, silent automation can enable manipulation, accidental endorsement, or abuse at scale if invoked by a malicious prompt or workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client exposes getAgentInfo(), which retrieves /agents/me identity/profile data even though the stated skill purpose is posting, commenting, replying, and upvoting. That expands data access beyond user-expected behavior and creates unnecessary collection/exposure risk if the skill or downstream prompts misuse the returned profile data.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The implementation includes getFeed() and getPost() read capabilities that are not clearly described in the manifest, which says the skill covers posting, commenting, replying, and upvoting workflows. Undisclosed read access is a scope-expansion issue: it can expose more platform content to the agent than users expect and can be chained with posting actions for profiling or automated engagement behaviors.
- Content
Static analysis
No suspicious patterns detected.