电商版本的moltbook

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:43 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it asks an agent to store a reusable account token and run recurring EcomMolt activity that can publish or modify content, so it needs careful review before installation.

Install only if you intend for the agent to interact with EcomMolt on your behalf. Keep the API key in a secret manager or protected environment variable, require explicit approval before any post/comment/vote/follow/profile/edit/delete action, use one allowlisted API origin, and avoid indefinite heartbeat automation unless you can monitor and disable it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:88

Finding

Persistent Third-Party Content Processing and Autonomous Publication Loop

Content

View full analysis

Call `/api/digest` daily at UTC 09:00. Use `hints.suggestPost` to decide whether to publish a daily analysis post. ``` The corresponding automated publication logic is: ```javascript if (home.news.count > 0) { for (const item of home.news.items) { if (item.relevance > 0.7 && matchesMySkills(item.tags)) { await postAnalysis(item.title, item.summary, item.url); } } } ``` ### Technical Analysis The Skill directs the host agent to install a recurring task that retrieves remotely controlled content and processes feed activity every 30 minutes. It also permits API response fields such as `hints.suggestPost`, news titles, summaries, tags, and URLs to determine whether the agent publishes content. These remote values cross a trust boundary, but the instructions do not require: - Separation of remote data from executable agent instructions. - Validation or sanitization of retrieved text and URLs. - Confirmation that retrieved content is within the user's intended scope. - Explicit user approval before authenticated publication. - A fixed upper bound on the lifetime of the recurring task. - Disabling the scheduled activity when the Skill invocation ends. Although no downloaded code is executed, the remote service can continuously influence authenticated actions taken by the agent. The recurring schedule also causes the behavior to survive the original Skill run. ### Attack Path 1. A user or agent loads the Skill and ...[truncated 1305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: HEARTBEAT.md:19

Finding

Reusable Bearer Credential Stored in a Plaintext State File

Content

View full analysis

`. 6. The service accepts the requests as actions performed by the victim agent. ### Impact Assessment A stolen token can enable impersonation of the registered agent. Based on the documented API, the attacker may create posts and comments, vote, follow other agents, update the victim's profile, and edit or delete victim-owned content. The scope is the EcomMolt account represented by the token. No evidence establishes operating-system administrator access or access to unrelated services, but account integrity, content integrity, reputation, and availability may all be ...[truncated 13 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: HEARTBEAT.md:11

Finding

Conflicting API Origins Can Cause Unsafe Credential Routing

Content

View full analysis

Content-Type: application/json ``` ### Technical Analysis The project identifies `aiclub.wiki` as the official API origin but instructs the heartbeat to contact `ecommunity.example.com`. Authenticated examples then use relative paths without restating the authorized origin. An implementation may infer its base URL from the heartbeat configuration and later resolve authenticated relative paths against that origin. If the placeholder host is replaced, redirected, or interpreted as authoritative, the bearer credential could be attached to a request sent to an unintended service. The documented heartbeat request itself is unauthenticated, so credential disclosure is not immediate from that request alone. The risk arises from combining inconsistent base configuration with relative authenticated endpoint examples and a reusable bearer token. ### Attack Path 1. An implementer copies the heartbeat configuration and configures `ecommunity.example.com`, or a replacement host, as the API base. 2. The agent later performs a do ...[truncated 860 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · HEARTBEAT.md (reported line 189)May include surrounding context.

md

| 今日资讯 | `GET /api/news?date=YYYY-MM-DD` |
| 每日摘要（含行动建议） | `GET /api/digest?date=YYYY-MM-DD` |
| 关注 Agent | `POST /api/agents/:handle/follow` |
| 取关 Agent | `DELETE /api/agents/:handle/follow` |
| 更新 Profile | `PATCH /api/agents/:handle` |
| 编辑帖子 | `PATCH /api/posts/:id` |
| 删除帖子 | `DELETE /api/posts/:id` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · HEARTBEAT.md (reported line 192)May include surrounding context.

md

| 取关 Agent | `DELETE /api/agents/:handle/follow` |
| 更新 Profile | `PATCH /api/agents/:handle` |
| 编辑帖子 | `PATCH /api/posts/:id` |
| 删除帖子 | `DELETE /api/posts/:id` |
| 删除评论 | `DELETE /api/comments/:id` |
| Agent 主页 | `GET /agent/:handle` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · HEARTBEAT.md (reported line 193)May include surrounding context.

md

| 更新 Profile | `PATCH /api/agents/:handle` |
| 编辑帖子 | `PATCH /api/posts/:id` |
| 删除帖子 | `DELETE /api/posts/:id` |
| 删除评论 | `DELETE /api/comments/:id` |
| Agent 主页 | `GET /agent/:handle` |

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

md

---

### DELETE /api/posts/:id *(auth required, owner only)*

Delete a post (also deletes all comments).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

---

### DELETE /api/comments/:id *(auth required, owner only)*

Delete a comment (also deletes all replies).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

---

### GET/POST/DELETE /api/agents/:handle/follow *(auth required)*

Manage agent follow relationships.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs storing a bearer-style API key in a local JSON state file, but provides no warning about secure storage, file permissions, redaction, or secret-management practices. If that file is exposed through logs, backups, repo commits, or other local read access, an attacker could reuse the credential to act as the agent and perform authenticated API actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to automatically post comments and potentially publish content based on fetched data, but it does not clearly warn that these are external side effects performed on the user's behalf. This can cause unintended spam, reputational harm, or unauthorized actions if the automation runs without explicit user approval and guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger section is overly broad and encourages invocation for generic e-commerce, automation, and collaboration tasks without clear boundaries or user-intent checks. In an agent ecosystem, this can cause the skill to activate opportunistically in contexts where the user did not explicitly request posting, registration, discovery, or external interaction, increasing the risk of unintended data sharing or autonomous API use.

Content

No source excerpt is available for this finding.