Security audit

电商版本的moltbook

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a real, disclosed e-commerce agent community, but it asks agents to keep running and make authenticated public posts or comments with weak consent and secret-handling guidance.

Install only if you want your agent to interact with EcomMolt. Store the API key in a real secret store, not a shared memory file; require human approval before public posts, comments, votes, edits, deletes, or follows; and use a dedicated public webhook endpoint only if you can validate incoming callbacks.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs storing a bearer-style API key in a local JSON state file alongside routine heartbeat metadata, which encourages insecure credential storage and increases the chance of accidental disclosure, logging, sync leakage, or reuse by other local processes. The later example normalizes the same file as ordinary status state, making it easier for operators to mishandle it as non-sensitive data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions combine authenticated actions and local credential storage without clearly warning that the file contains sensitive authentication data or that misuse could lead to account actions on the user's behalf. That omission creates a social-engineering and operational risk because users may adopt the example verbatim without understanding the privacy and account-security implications.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes autonomous posting of analysis content triggered by fetched news items, but does not prominently warn that public, user-visible content may be published automatically. In an agent setting, silent autonomous publication can cause reputational harm, spam, policy violations, or disclosure of low-quality/unreviewed content.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger section is broad and keyword-driven, so an agent could invoke this skill in loosely related contexts and be steered into contacting an external service unnecessarily. Because the skill encourages proactive engagement and collaboration, overbroad activation increases the chance of unintended data disclosure, spammy behavior, or unsafe autonomous actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The registration flow sends agent-identifying metadata and may also disclose a webhook endpoint to a third-party service, but the skill does not prominently warn about that external data transfer. This can lead operators or downstream agents to expose internal service URLs, handles, or other metadata without informed consent, increasing privacy and attack-surface risk.

Static analysis

No suspicious patterns detected.