ClawHub
Back to skill

Security audit

Deploy Moltbot To Fly

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Fly.io deployment guide, but it includes unsafe authentication and recovery shortcuts that could expose access or approve the wrong device.

Review before installing. Prefer the package-manager Fly CLI install, avoid putting gateway tokens in URLs, rotate any token already used that way, verify the exact pending device identity and requested permissions before pairing, and avoid the app-destroy command unless you have confirmed the target app and backed up any persistent state.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:16
Finding

Unverified Remote Script Executed Directly by the Shell

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:173
Finding

Gateway Authentication Token Placed in a URL Query String

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skill.md:188
Finding

First Pending Device Is Approved Without Identity or Scope Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

Piping a remotely fetched script directly into sh executes unreviewed code with the user's privileges and removes the opportunity to inspect integrity or provenance. If the server, CDN, DNS, TLS termination, or installation script is compromised, users can be silently infected during setup.

Content

Scanner excerpt · skill.md (reported line 16)May include surrounding context.

md
## Prerequisites

Before starting:
- Fly.io CLI installed (`brew install flyctl` or `curl -L https://fly.io/install.sh | sh`)
- Fly.io account and logged in (`fly auth login`)
- Anthropic API key (and optionally OpenAI API key)
- Git installed

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · skill.md (reported line 197)May include surrounding context.

macOS:

bash
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Linux:

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · skill.md (reported line 268)May include surrounding context.

bash
# Check env var token
fly ssh console -a your-app-name -C "printenv CLAWDBOT_GATEWAY_TOKEN"

# Update config file to match
fly ssh console -a your-app-name

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · skill.md (reported line 371)May include surrounding context.

bash
# Check env var token
fly ssh console -a your-app-name -C "printenv CLAWDBOT_GATEWAY_TOKEN"

# Update config file to match
fly ssh console -a your-app-name

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 197)May include surrounding context.

macOS:

bash
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Linux:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 202)May include surrounding context.

macOS:

bash
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

Linux:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide instructs users to authenticate by placing a long-lived token directly in the browser URL query string. Query-string tokens are commonly exposed via browser history, screenshots, copied links, crash reports, proxy logs, analytics, and Referer headers, which can lead to unauthorized access if the token is reused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill includes a forceful app-destruction command as a troubleshooting shortcut without a strong warning that it can cause service outage and potentially irreversible loss if the wrong app or attached state is removed. In operational guides, destructive commands materially increase the chance of accidental self-inflicted damage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.