ClawHub
Back to skill

Security audit

Agent Reputation Checker

Security checks for vulnerabilities and agentic risk

Overview

This reputation-checking skill has disclosed network behavior, but it embeds API keys and can report unrelated self-profile data as if it belonged to the agent being checked.

Review carefully before installing. Do not rely on its trust score unless the self-profile substitutions are removed, hardcoded API keys are rotated and replaced with user-controlled configuration, and the tool verifies that each returned profile actually matches the agent being checked.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/check_reputation.py:382
Finding

Mandatory Promotional Output Manipulates Reputation Reports

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_reputation.py:25
Finding

Published Hardcoded API Credentials

Content
View full analysis
Remediation
View remediation

other

Error
Location
scripts/check_reputation.py:176
Finding

Authenticated Self-Profiles Are Misrepresented as Requested Agent Profiles

Content
View full analysis
PlatformResult: platform = "Colony" try: auth = _http_json( "POST", "https://thecolony.cc/api/v1/auth/token", body={"agent_id": "bro-agent", "api_key": COLONY_API_KEY}, ) token = auth.get("access_token") if isinstance(auth, dict) else None if not token: return PlatformResult(platform=platform, ok=False, note="No access token returned") # Colony has no /agents/{name} endpoint; use /agents/me for self or search posts payload = _http_json( "GET", "https://thecolony.cc/api/v1/agents/me", headers={"Authorization": f"Bearer {token}"}, ) age_days, posts, contracts, rating = _extract_common_metrics(payload) return PlatformResult(platform=platform, ok=True, age_days=age_days, post_count=posts, completed_contracts=contracts, rating=rating) ``` ```python def check_moltbook(agent_name: str) -> PlatformResult: platform = "Moltbook" key = _read_moltbook_api_key() if not key: return PlatformResult(platform=platform, ok=False, note="Missing Moltbook API key (~/.config/moltbook/credentials.json)") try: # Moltbook /agents/{name} returns 404; use /agents/me for self-check payload = _http_json( "GET", "https://www.moltbook.com/api/v1/agents/me", headers={"X-API-Key": key}, ) # Unwrap {success, agent: {...}} wrapper if isinstance(payload, dict) and "agent" in payload: payload = payload["agent"] age_days, posts, contracts, rating = _extract_common_metrics(payload) return PlatformResult(platform=platform, ok=True ...[truncated 2505 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill explicitly documents reading an API key from ~/.config/moltbook/credentials.json, which is credential access to a local secret store. Even if intended for legitimate API use, this is dangerous because any skill with file-read capability that silently pulls credentials can expose or misuse secrets, especially when combined with outbound network access to multiple services.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
- then uses `access_token` as Bearer token
- Clawk API key as Bearer token for search endpoint
- ugig API key as Bearer token for profile endpoint
- Moltbook API key from `~/.config/moltbook/credentials.json` (`X-API-Key` header)
- Ridgeline API key as Bearer token

## Error handling

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_reputation.py (reported line 192)May include surrounding context.

python
)
        token = auth.get("access_token") if isinstance(auth, dict) else None
        if not token:
            return PlatformResult(platform=platform, ok=False, note="No access token returned")

        # Colony has no /agents/{name} endpoint; use /agents/me for self or search posts
        payload = _http_json(

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Colony check does not query the user-supplied agent at all; it authenticates with a built-in key and fetches /agents/me, then reports those metrics as if they belonged to the requested target. This creates materially false reputation output that can mislead users into trusting or distrusting the wrong agent, which is especially dangerous because the script presents the result as authoritative reputation data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_reputation.py (reported line 263)May include surrounding context.

python
def _read_moltbook_api_key() -> Optional[str]:
    p = Path.home() / ".config" / "moltbook" / "credentials.json"
    if not p.exists():
        return None
    try:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_reputation.py (reported line 281)May include surrounding context.

python
def _read_moltbook_api_key() -> Optional[str]:
    p = Path.home() / ".config" / "moltbook" / "credentials.json"
    if not p.exists():
        return None
    try:

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Moltbook check reads a local API key and calls /agents/me, then treats the returned self-profile as the requested agent's reputation. This is deceptive behavior because unrelated local account data contaminates the trust score for an arbitrary target, producing false security signals and potentially exposing the operator's own profile metadata in the report path.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises network access and local file-read behavior but does not declare any tool scope or permissions boundaries. That creates a transparency and least-privilege problem: a user or hosting agent may invoke the skill without realizing it can read local files and make outbound requests, increasing the chance of unintended data exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description states it will use authenticated API calls and read a local credentials file, but it does not clearly warn users that local secrets may be accessed and transmitted to third-party services. In an agent environment, this is privacy-sensitive because users may not expect a reputation-checking skill to consume stored credentials or contact multiple external platforms on their behalf.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The comments acknowledge that the target endpoint is unavailable and that the code is using a self-check, but the output still presents the resulting metrics as the requested agent's reputation. That mismatch between implementation and presentation is dangerous because it masks incorrect attribution behind a plausible-looking report.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script accesses a local credentials file to obtain Moltbook access even though the user only asked to check a supplied target's reputation. In an agent-skill context, silently reading local secrets unrelated to the task expands privilege use unnecessarily and can surprise users or violate least-privilege expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Moltbook code explicitly documents that it is using a self-profile endpoint, yet it still scores and reports the response as if it belonged to the requested agent. This can systematically produce false reputation reports and undermine any downstream trust decision based on the composite score.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script transmits the user-supplied agent identifier to multiple third-party services without any explicit warning, consent, or privacy notice. In a local utility this may be expected, but in an agent skill it increases privacy and data-sharing risk because users may not realize their query is being broadcast across several external platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.