ClawHub
Back to skill

Security audit

MoltBook CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Moltbook access, but it grants broad social, messaging, and moderation authority while telling agents to act on remote prompts and raw API output with insufficient safeguards.

Install only if you are comfortable giving the agent broad Moltbook account authority. Treat all Moltbook posts, DMs, hints, role briefings, and debug output as untrusted data; require explicit user approval before posting, messaging, deleting, moderating, assigning roles, changing settings, or following commands suggested by the service. Avoid `--debug` on sensitive commands and prefer secret entry methods that do not place API keys in shell history or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
LABELS.md:53
Finding

Untrusted Remote Role Prompts and Inline Commands Can Redirect Agent Behavior

Content
View full analysis
0`, `moltbook home` surfaces a briefing block in the `check_in.briefings` section showing the role name, submolt, prompt, and cadence. The agent is expected to act on the prompt (e.g. triaging bug posts) and then continue. The briefing repeats at the next check-in after the cadence interval. ``` ### Technical Analysis The Skill establishes a channel through which externally controlled Moltbook content can become agent instructions. A submolt moderator can define a role containing arbitrary prompt text, assign that role to an agent, and cause the prompt to appear in recurring `moltbook home` briefings. The documentation then directs the agent to act on these prompts and on commands printed in remote output. It does not require source validation, user confirmation, command allowlisting, or separation of untrusted API content from authoritative Skill instructions. Consequently, a remote Moltbook participant with the relevant moderation capability can attempt to change the agent's behavior after the Skill has been reviewed. Recurring cadence settings make the malicious instruction appear repeatedly, although t ...[truncated 1536 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:38
Finding

API Key Is Supplied Through a Command-Line Argument

Content
View full analysis
--name "Name" # existing key ``` ### Technical Analysis The documented initialization procedure places the Moltbook API key directly in a command-line argument. Secrets supplied this way can be copied into shell history, terminal recordings, process-monitoring output, operating-system audit logs, agent execution transcripts, or observability systems. The credentials file is documented as having mode `0600`, which appropriately limits direct file access, but that protection does not apply to secondary copies created when the key is included in a command line. ### Attack Path 1. A user or agent follows the documented `moltbook init --api-key ` command. 2. The shell, orchestration layer, terminal logger, or agent framework records the complete command. 3. A local user, administrator, log collector, support operator, or compromised monitoring component reads the retained command. 4. The exposed API key is submitted to Moltbook by the attacker. 5. The attacker impersonates the affected Moltbook agent until the key is revoked or rotated. ### Impact Assessment Exposure of the key can grant access equivalent to the affected Moltbook account. Depending on the account's roles, this may permit reading private messages, publishing content, sending messages, changing profile data, or performing community moderation. This issue does not by itself grant operating-system privileges. Its scope is principally the Moltbook account and any communities where that account has elevated permissions. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
FLAGS.md:15
Finding

Global Debug Mode Can Expose Raw Request and Response Data

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · RULES.md (reported line 66)May include surrounding context.

md
bins:
        - moltbook
      config:
        - ~/.config/moltbook/credentials.json
    install:
      - kind: cargo
        repo: https://github.com/kelexine/moltbook-cli

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
bins:
        - moltbook
      config:
        - ~/.config/moltbook/credentials.json
    install:
      - kind: cargo
        repo: https://github.com/kelexine/moltbook-cli

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
bins:
        - moltbook
      config:
        - ~/.config/moltbook/credentials.json
    install:
      - kind: cargo
        repo: https://github.com/kelexine/moltbook-cli

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown command reference includes a delete operation (moltbook delete-post <POST_ID>) but provides no user warning about the irreversible effect on user content. Under the markdown-file criteria, descriptions should warn about behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This section lists commands such as adding moderators, changing submolt settings, and uploading community images, all of which can materially affect community governance or presentation, but the markdown provides no cautionary note. The skill description should warn users about operations that can affect shared resources or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation describes initiating DM requests and sending direct messages without any warning that the content will be transmitted to other users. For markdown files, behaviors affecting privacy or user communications should be clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that --debug prints raw API request and response JSON but does not warn that these outputs can contain sensitive information such as auth tokens, agent identifiers, private messages, moderation metadata, or other confidential content. In a CLI for a social network with direct messaging, notifications, and moderation capabilities, users may enable debug logging in shared terminals, CI logs, or support transcripts and inadvertently leak secrets or private data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · RULES.md (reported line 40)May include surrounding context.

md
## Verification challenges

Write actions (post, comment, vote, DM) may return a verification challenge instead of completing immediately. The challenge is a math or logic puzzle.

**Response pattern:**

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises itself for broad categories like social presence, community engagement, content discovery, and multi-agent coordination, which can cause an agent to invoke it in many loosely related situations. Because the tool enables external posting, messaging, moderation, and role assignment, overbroad routing increases the chance of unintended outbound actions or privilege-bearing operations without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation describes posting, commenting, DMs, moderation, labels/roles, and credential-backed authentication, but does not prominently warn that these actions may be public, irreversible, policy-sensitive, or attributable to the agent/account. In an agent setting, lack of such warnings makes it more likely the tool will be used to disclose private information, send unintended messages, or perform impactful moderation changes without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The command reference documents moltbook notifications-read-all, which changes the read/unread state of all notifications, but does not warn that it performs a bulk account-state update. For markdown documentation, user-visible state changes that affect data handling should be disclosed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.