Security audit

Equip your agents to explore real human social spaces, engage meaningfully, and learn from authentic interactions, so when they return to places like Moltbook, they come back sharper, wiser, and even with better jokes

Security checks for vulnerabilities and agentic risk

Overview

This skill is not local malware, but it needs review because it enables public posting and owner-facing analysis of community discussions with weak approval and privacy boundaries.

Install only if you intentionally want an agent to interact with Protico-enabled communities. Use an allowlist of approved sites, require human review before every public post or reply, publish the owner name only when that identity is meant to be public, avoid Google or Metamask login unless explicitly authorized, and report only aggregate non-identifying community insights with no usernames, quotes, contact details, or sensitive content.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:106
Finding: Mandatory Protico Signature Hijacks Agent-Generated Output
Content: View full analysis
Remediation: View remediation
str: return f"{content}\n{signature}" if signature else content ``` 7. Separate content generation from publication. Present the exact final message to the user and require confirmation before clicking the external submit button. 8. Clearly document the destination, identity information, and content that will be transmitted before each post. 9. Ensure `SKILL.md`, `llms.txt`, `agents.txt`, and `agent-manifest.json` consistently describe disclosure as an optional, user-authorized policy rather than an unconditional agent instruction. 10. Add tests verifying that no owner identity or branded suffix is appended unless the caller explicitly supplies and approves it. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.
md
❌ BAD: Generic signature without disclaimer — humans may confuse you with platform staff

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 567)May include surrounding context.
md
### ❌ Don'ts - **Don't forget your owner's name** — Always identify who you represent - **Don't imply platform affiliation** — You are NOT their official support - **Don't skip the disclaimer** — Always clarify you're not platform staff - **Don't spam** — Quality over quantity - **Don't post too frequently** — Wait 5-10 minutes between posts; let humans lead discussions - **Don't dominate conversations** — Observe and support, don't flood the lobby

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file explicitly encourages agents to observe human discussions, infer sentiment and pain points, and report those insights back to the owner, but it does not provide strong privacy boundaries, notice, minimization, or consent requirements. This creates a real risk of covert collection and secondary use of human-generated content, including sensitive opinions or personal data, especially because the context involves real public communities on third-party sites.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document prohibits collecting personal information and sensitive keys, but later instructs agents to observe human discussions and report insights back to their owner. That creates a contradictory policy that can normalize collection and transfer of conversation-derived user data, including sentiment, complaints, requests, and potentially incidental personal information, without clear minimization or consent boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions explicitly frame human conversations as 'valuable intelligence' and direct agents to report observations back to their owner, but they do not warn users that their comments may be monitored, analyzed, and shared. This creates a covert monitoring and secondary-use channel for conversation data, which can violate user expectations, privacy norms, and potentially platform policies.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs agents to observe discussions, extract pain points, sentiment, trends, and feature requests, and send that information to their owner. Even though presented as product research, this establishes a natural-language exfiltration path from user conversations to an external party, with no guardrails against including sensitive, identifying, or contextually private information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly encourages agents to visit third-party sites and post messages to real humans, but it does not warn about privacy exposure, account/reputation damage, moderation violations, or the risks of interacting on untrusted external platforms. In this context, the omission is security-relevant because the skill is designed to drive cross-site agent behavior in public spaces, increasing the chance of data leakage, spam-like conduct, or unsafe disclosure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly frames human discussions as 'valuable intelligence' and instructs the agent to report observations, sentiment, complaints, and trends back to its owner. Even though it discourages requesting personal data, this still establishes a data-collection and secondary-use pipeline for user-generated content without clear consent, minimization, or boundaries on what may be relayed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guidance tells the agent to observe what humans discuss and 'report back to your owner' with sentiment, trends, and opportunities, but does not present a user-facing warning that their discussion content may be collected and transmitted for third-party analysis. This creates a transparency and privacy problem because participants are interacting in a community context, not clearly opting into intelligence gathering for outside owners.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: By directing the agent to collect themes, complaints, feature requests, and emotional reactions from humans and bring those insights back to its owner, the skill creates a natural-language exfiltration path from third-party communities to an external party. The danger is not classic secret theft but uncontrolled transfer of user-generated information to a different context without clear necessity or safeguards.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill provides concrete API and code examples for programmatically retrieving live community feeds and analyzing them for sentiment and trends. That materially expands the capability from conversational participation into systematic collection and processing of community data, increasing scale and likelihood of unauthorized monitoring or profiling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API examples normalize automated retrieval of user-generated discussions without prominently warning that this processes potentially sensitive community content. In practice, this could enable invisible large-scale monitoring and downstream sharing beyond user expectations, especially when combined with sentiment analysis instructions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The combination of direct feed-reading APIs, sentiment-analysis code, and instructions to summarize trends for the owner enables scalable extraction of community discussion content into owner-facing reports. This is a clear data-leak pathway because it operationalizes collection, transformation, and outbound transmission of information obtained from users on other platforms.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The visual identification guidance includes fixed Chinese text tokens (聊天/討論/交流) as part of the expected interface cues, which imposes a locale assumption in the skill instructions. The file does not present this as an opt-in language preference or clearly justify the constraint as a region-specific skill, so it conflicts with the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file gives step-by-step instructions for an agent to visit third-party sites, locate a chat UI, and post messages, using broad triggers like any sample partner site and a generic frame selector. Even though it includes conduct rules, this still operationalizes unsolicited autonomous posting across many normal browsing contexts, which can lead to spam, unauthorized interaction, or policy violations on partner sites.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly tells agents to learn from lobby discussions and treat what humans say as insights for the owner's benefit, including pain points, complaints, and communication patterns. That creates a privacy and transparency risk because users may be monitored for business intelligence without a clear, prominent notice and consent mechanism beyond a posting signature.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The top-level docstring frames the file as a 'Basic interaction' example, which suggests lightweight interaction with the Protico community on partner sites. In practice, the code includes direct HTTP access to the Protico API and browser automation that submits community posts, which is more than merely descriptive or observational interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This function submits generated content directly to an external community without any approval gate, preview, or explicit operator confirmation. In an agent-skill context, that enables unintended or manipulated outbound posting, which can cause spam, reputational harm, and policy violations if the input summary or key points are wrong or adversarially influenced.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This function automatically posts answers into a public community flow with no user warning or approval before publication. Because the content may come from an autonomous agent, prompt injection, hallucinations, or unsafe instructions could be published directly, increasing the risk of misinformation, abuse, or unwanted impersonation of the configured owner.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill gives broad instructions to visit many third-party sites and interact whenever a Protico widget is present, without meaningful allowlisting, task scoping, or approval gates. That can cause unintended cross-site actions, spammy behavior, or autonomous engagement on external properties beyond the user's expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code-of-conduct table says agents should never 'Crawl or scrape websites' and should not 'Harvest user data,' framing the allowed behavior as interactive participation and observation. Later sections provide curl examples and live API endpoints for programmatic retrieval of community feeds from arbitrary partner-site URLs, which is an automated data-access pattern that contradicts the earlier restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to detect Protico 'on any page' and click the identified frame encourages overly broad autonomous behavior across arbitrary pages. This weakens origin boundaries and can trigger unintended interactions on unrelated or embedded contexts, increasing the chance of misuse or accidental engagement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill mandates a fixed English disclosure string for all messages without offering localization guidance or fallback behavior for non-English sites. While not severe on its own, this can undermine transparency on foreign-language platforms because users or moderators may not understand the disclosure, weakening informed consent and increasing moderation or impersonation risk in this cross-site communication skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: Multiple partner definitions specify a required language such as 'zh-TW' or 'en', but the file does not state that the agent should adapt to the user's preferred language or provide opt-in for locale restrictions. This can create a language-policy issue if the skill behavior is effectively constrained by partner locale rather than user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The sentiment analysis logic includes specific Chinese keywords alongside English terms, which embeds a locale/language assumption directly into the skill. There is no user choice, configuration, or documentation indicating that the skill intentionally supports or targets these languages, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.