T09 · Insecure Skill Coding Practices
- Location
test_api.py:4- Finding
Hardcoded Moltbook API Bearer Token
- Content
View full analysis
Vulnerability Details
File Location:
test_api.py, lines 4–12
Vulnerability Type: Hardcoded API credential
Risk Level: HighVulnerable Code
python API = "https://www.moltbook.com/api/v1" TOKEN = "moltbook_sk_h_WdHz8lcsCi_-tUAgZtMZEAVcg22chm" def auth(): return {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"} def get(path): req = urllib.request.Request(f"{API}{path}", headers=auth()) with urllib.request.urlopen(req, timeout=15) as r: return json.loads(r.read().decode())Technical Analysis
A Moltbook bearer token is embedded directly in source code and transmitted in the
Authorizationheader. Anyone who can read the project package, repository history, build artifact, backup, or log containing this file can recover the credential without needing system-level access.Bearer tokens generally confer access based solely on possession. Although the exact server-side permissions were not established during this static audit, the token is demonstrably intended to authenticate requests to the Moltbook API. Storing it in a test script violates secret-management and least-privilege principles.
The credential should be considered compromised even if the file is subsequently deleted, because it may remain in previously distributed artifacts or version-control history.
Attack Path
- An attacker obtains a copy of the project or reads
test_api.py. - The attacker extracts the token from line 5.
- The attacker sends requests to
https://www.moltbook.com/api/v1with:http Authorization: Bearer [extracted token] - Moltbook processes requests under the identity and permissions associated with the token.
- The attacker reads or modifies any resources permitted by that token until it is revoked.
Impact Assessment
Successful exploitation permits impersonation of the token owner within the token’s server-side scope. Confirmed code usage includes authenticated access t ...[truncated 334 chars]
- An attacker obtains a copy of the project or reads
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed token immediately.
- Review Moltbook account activity for unauthorized API calls made with the compromised credential.
- Remove the token from the current source and all version-control history, releases, archives, and build artifacts.
- Load the replacement credential from a secret manager or protected environment variable:
python import os TOKEN = os.environ.get("MOLTBOOK_API_KEY") if not TOKEN: raise RuntimeError("MOLTBOOK_API_KEY is not configured") - Use a separate, minimally scoped, read-only credential for API tests.
- Prevent secrets from entering source by enabling secret scanning in pre-commit and CI workflows.
- Avoid printing authorization headers or complete API responses if they may contain sensitive account information.
- Where supported, configure short token lifetimes, IP restrictions, operation-level scopes, and regular automated rotation.