疯信子Moltbook日报

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:59 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Moltbook report generator, but it concentrates service credentials locally and can upload generated content externally with under-scoped automation and implementation risks.

Review this skill before installing. Use narrowly scoped Moltbook/GetNote credentials, avoid storing SMTP passwords in the provided .env file, replace the unsafe environment loading pattern, inspect generated reports before upload, and avoid enabling the cron job until logging and external-upload behavior are made explicit and reversible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:103

Finding

Plaintext Credential Storage and Fragile Environment Loading

Content

View full analysis

~/.config/moltbook-generator/.env << 'EOF' # Moltbook API（必需） MOLTBOOK_API_KEY="your_moltbook_api_key" # Get笔记配置（必需） GETNOTE_API_KEY="your_getnote_api_key" GETNOTE_CLIENT_ID="your_getnote_client_id" # 邮件配置（可选） SMTP_HOST="smtp.163.com" SMTP_PORT=465 SMTP_USER="[e-mail]" SMTP_PASSWORD="your_smtp_password" RECIPIENT="[e-mail]" EOF # 设置权限 chmod 600 ~/.config/moltbook-generator/.env ``` ```bash export $(cat ~/.config/moltbook-generator/.env | xargs) ``` ### Technical Analysis The documented setup stores Moltbook, GetNote, and SMTP credentials in a persistent plaintext file at a predictable location. Setting mode `600` is an appropriate mitigating control, but it does not protect the credentials from processes running as the same user, privileged users, accidental backups, or disclosure caused by incorrectly preserved permissions. The command used to load the file is also fragile. Command substitution followed by unquoted expansion performs shell word splitting and pathname expansion. `xargs` additionally changes whitespace and quote handling. Secrets containing spaces, wildcard characters, quotes, or other special characters can therefore be corrupted or split into unintended arguments to the `export` builtin. This loading construction does not, by itself, re-evaluate arbitrary shell operators from the file as executable syntax. Nevertheless, anyone able to alter the file can control which environment variables are exported to the Skill and can affect commands that trust those variables. ### Attack Path 1. A local process operating as the same user, a privileged process, or a backup/logging mechanism obtains access to `~/.config/moltbook-generator/.env`. 2. The process reads reusable Moltbook, GetNote, or SMTP credentia ...[truncated 983 chars]

Remediation

View remediation

&2 exit 1 fi set -a # shellcheck disable=SC1090 . "$ENV_FILE" set +a ``` 4. Because sourcing executes shell syntax, only use that approach with a trusted, owner-only file. For stronger isolation, parse an allowlist of expected keys without evaluating the file as shell code. 5. Use narrowly scoped API credentials, rotate exposed credentials, and avoid storing SMTP account passwords when a revocable application-specific token is available. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.sh:101

Finding

Python Code Injection Through Inline Report Serialization

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.sh:37

Finding

Predictable Shared Temporary Log Permits Symlink-Based File Writes

Content

View full analysis

> "$LOG_FILE" else echo "⚠️ GetNote保存失败: $RESULT" echo "$(date) - FAILED: $RESULT" >> "$LOG_FILE" fi ``` ### Technical Analysis The default log is a predictable path in the globally shared `/tmp` directory. The script appends to this path without checking whether it is a regular file, whether it is owned by the expected user, or whether it is a symbolic link. On systems where another local user can create `/tmp/moltbook.log` first, that user can make it a symbolic link to another path. Shell append redirection follows the link. The script may consequently append its status or the complete GetNote response to an unintended file. The failure path also records the entire remote API response. Such responses can contain internal identifiers, diagnostic details, or reflected content and should not automatically be persisted in a shared temporary location. ### Attack Path 1. A local attacker predicts the default path `/tmp/moltbook.log`. 2. Before the scheduled or manual execution, the attacker creates that path as a symbolic link to a file writable by the victim account. 3. `generate.sh` executes and reaches either the success or failure branch. 4. The `>> "$LOG_FILE"` redirection follows the symbolic link. 5. The script appends controlled or remote-response-derived text to the target file. The target must be writable by the account running the Skill. If the Skill runs as an ordinary user, the attacker can generally target only files that user can modify. If it is unnecessarily run as root, the write scope becomes substantially larger. ### Impact Assessment The vulnerabili ...[truncated 494 chars]

Remediation

View remediation

&2 exit 1 fi ``` 3. Create new files atomically with restrictive permissions. For temporary data, use `mktemp` in a private directory. 4. Log only a sanitized error category, HTTP status, and request correlation identifier. Do not persist complete remote responses unless explicitly required and reviewed. 5. Do not run the Skill as root. The documented functionality only requires the invoking user's file and network permissions. 6. Configure log rotation and retention so API diagnostics are not stored indefinitely. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior and the effective behavior are mismatched: the skill claims content collection and AI analysis, but also describes external publication/storage and email workflows without clear disclosure in the top-level purpose. Such mismatches are dangerous because users may authorize or invoke the skill under false assumptions, leading to unintended data transmission or trust in fabricated analysis output.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill instructs users to place multiple API keys and SMTP credentials into a plaintext .env file under the home directory. While common, this creates a credential concentration point that can be exposed by weak host hygiene, accidental backups, logs, or other local tooling with file access.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

mkdir -p ~/.config/moltbook-generator

# 创建环境变量文件
cat > ~/.config/moltbook-generator/.env << 'EOF'
# Moltbook API（必需）
MOLTBOOK_API_KEY="your_moltbook_api_key"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

EOF

设置权限

chmod 600 ~/.config/moltbook-generator/.env

text

### 3. 获取API Key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The command export $(cat ~/.config/moltbook-generator/.env | xargs) is unsafe for loading secrets because it performs shell word-splitting and can mangle values or expose them through process state and shell history/workflows. It also normalizes a pattern where sensitive credentials are injected into the active shell environment, increasing accidental leakage to child processes and logs.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

bash

# 方式1: 配置环境变量后运行
export $(cat ~/.config/moltbook-generator/.env | xargs)
bash scripts/generate.sh

# 方式2: 直接指定环境变量

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents shell execution (bash scripts/generate.sh, file creation, cron setup) but does not declare any tool scope or allowed tools. This weakens containment and user awareness, making it easier for a host agent to invoke shell capabilities more broadly than the skill metadata suggests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad and generic enough that ordinary conversation about Moltbook reports or updates could unintentionally activate the skill. In a skill capable of shell execution and external transmission, accidental invocation increases the chance of unintended network access, credential use, or data publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises storage to GetNote and optional email delivery but does not prominently warn that collected content and configured account-linked data may be transmitted to third-party services. Lack of disclosure undermines informed consent and can expose sensitive or regulated content through external APIs or email channels.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash

# 创建配置目录
mkdir -p ~/.config/moltbook-generator

# 创建环境变量文件
cat > ~/.config/moltbook-generator/.env << 'EOF'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash

# 创建配置目录
mkdir -p ~/.config/moltbook-generator

# 创建环境变量文件
cat > ~/.config/moltbook-generator/.env << 'EOF'

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

EOF

设置权限

chmod 600 ~/.config/moltbook-generator/.env

text

### 3. 获取API Key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The cron instructions establish recurring execution, which creates persistence for ongoing network access, credential use, content collection, and external uploads. Persistence is not inherently malicious here, but it increases blast radius if the script misbehaves, is later modified, or silently transmits more data than intended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

bash

# 添加到crontab
crontab -e

# 每天20点执行
0 20 * * * /path/to/moltbook-generator/scripts/generate.sh >> /path/to/logs/moltbook.log 2>&1

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file defines exclusion keywords and display dimensions entirely in Chinese, which imposes a specific language/locale in the skill configuration. There is no indication here that the skill is region-specific or that users can opt into this locale, so this appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes collecting Moltbook热门内容 and generating an analyzed report, but this script also supports configuring a recipient and SMTP password for email delivery. Sending the generated report by email is a separate distribution capability that is not stated in the manifest and is not necessary to collect, deduplicate, analyze, or save the report.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The script sends generated report content to an external third-party API using credentials from environment variables. While this is consistent with the skill's stated integration with GetNote, it is still a real data-exfiltration boundary: any content placed in the report, including unintended sensitive data from upstream collection or prompts, will be transmitted off-host. In an agent automation setting, this is more dangerous because transmission happens non-interactively and without content review or destination confirmation.

Content

Scanner excerpt · scripts/generate.sh (reported line 117)May include surrounding context.

sh

CONTENT=$(cat "$OUTPUT_FILE")
JSON_CONTENT=$(python3 -c "import json; print(json.dumps('''$CONTENT'''))")

RESULT=$(curl -s -X POST "https://openapi.biji.com/open/api/v1/resource/note/save" \
  -H "Authorization: ${GETNOTE_KEY}" \
  -H "X-Client-ID: ${GETNOTE_CLIENT}" \
  -H "Content-Type: application/json" \

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

A hard-coded default recipient can cause report content to be sent to an unintended third party if SMTP support is later enabled without the operator explicitly setting a recipient. In an agent skill context, automated execution increases the chance of silent data leakage because users may assume output remains local or only goes to configured services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.