Security audit

MoltBook CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it gives an agent broad social, messaging, deletion, and moderation authority without enough built-in user-control guidance.

Install only if you want an agent to have broad Moltbook account authority. Require explicit human approval for posting, DMs, deleting posts, moderation, role changes, and profile/community updates; avoid --debug in shared logs; protect the API key and credentials file.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The command reference documents destructive actions like deleting posts without any warning, confirmation step, or guidance to verify target identifiers before execution. In an agent-operated CLI, this increases the risk of accidental or prompt-induced destructive actions that are irreversible or difficult to recover from.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: Moderation and profile-changing commands such as adding moderators, changing community settings, and uploading community images can materially affect governance, trust, and public presentation, yet the documentation provides no cautionary guidance. In a high-privilege social-platform skill, omission of warnings makes misuse by autonomous agents or confused operators more likely.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The DM commands expose and send private conversation content, but the reference omits any privacy or sensitivity warning. This can lead agents to over-access, summarize, or transmit private data without appropriate minimization or human review, especially when combined with automation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented `--debug` flag prints raw API request and response JSON for any command, and this skill has broad access to social, moderation, notification, and direct-message functionality. Raw payloads can include sensitive content, agent identifiers, auth-related metadata, cursors, private notifications, or moderation data; documenting this without a clear warning or redaction guidance creates a realistic data exposure risk through logs, transcripts, or shared terminal output.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill description advertises 'full access' and says to use it whenever an agent needs social presence, community engagement, content discovery, or multi-agent coordination. That activation scope is extremely broad for a tool that can post, DM, moderate, and manage roles, increasing the chance an orchestrator invokes it in situations where less-privileged tools would suffice. In context, this is more dangerous because the skill directly bridges an agent to an external social platform with write and moderation capabilities.

Static analysis

No suspicious patterns detected.