T09 · Insecure Skill Coding Practices
Warning
- Location
references/onboarding.md:51- Finding
Long-Lived API Key Stored in an Unprotected Plaintext File
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltoffer Recruiter
Security checks for vulnerabilities and agentic risk
Overview
This recruiter skill is mostly coherent, but it grants broad autonomous authority to post and message candidates and has unsafe credential handling.
Review this carefully before installing. Use it only with a dedicated, revocable MoltOffer API key, avoid running YOLO mode unless you accept unsupervised candidate replies, and do not let it use generic TOKEN environment variables or persist unreviewed persona changes.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/workflow.md:106- Finding
Inconsistent Authentication Instructions Can Leak an Unrelated Bearer Token
- Content
View full analysis
/comments" ``` ```bash curl -X POST "https://api.moltoffer.ai/api/ai-chat/moltoffer/posts//comments" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{"content": "", "parentId": ""}' ``` ### Technical Analysis The Skill states that all requests must use a dedicated `X-API-Key` header containing a `molt_*` key, but every operational workflow example instead uses `Authorization: Bearer $TOKEN`. The variable `$TOKEN` is not defined, validated, or scoped anywhere in the project. In environments where a generic `TOKEN` variable already contains a GitHub token, deployment token, cloud token, or another bearer credential, directly following these examples transmits that unrelated credential to `api.moltoffer.ai`. This exceeds the minimum privilege necessary for the declared functionality because the Skill only needs the dedicated MoltOffer API key. Even if `$TOKEN` is intended to contai ...[truncated 1216 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:114- Finding
Unrestricted User Content Is Directed into Persistent Persona State
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly authorizes storing a long-lived API key in a local file, but provides no warning about workstation compromise, file permission hardening, backup/sync leakage, or multi-user environment exposure. Because this recruiter skill handles an authentication secret that can act on behalf of the agent account, local persistence increases the chance of credential theft and unauthorized posting or candidate interaction if the host is compromised or the file is mishandled.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The onboarding flow instructs the agent to collect a sensitive API key from the user and persist it in a local JSON file without any guidance on secure storage, file permissions, encryption, or use of an OS credential store. If the local filesystem is accessible to other users, malware, backups, logs, or source-control mistakes, the key could be exposed and then used to access the user's MoltOffer recruiter account and associated actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The YOLO mode explicitly enables autonomous looping, candidate evaluation, and automatic reply sending without per-action confirmation or a prominent warning about continuous external reads/writes. In a recruiting context, this can cause ongoing unsupervised outbound communications and repeated API activity, leading to unintended candidate contact, reputational harm, and privacy/compliance issues if the agent misclassifies or hallucinates responses.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The instruction to keep running indefinitely and not ask the user what to do removes a key safety checkpoint for a workflow that reads candidate data and sends external messages. In this context, suppressing user intervention increases the chance of prolonged unauthorized actions, runaway messaging, and accumulation of mistakes before detection.
- Content
md **Never auto-exit**: - YOLO mode must keep running, even with consecutive empty cycles - Don't ask user what to do or auto-exit just because no pending replies - Must `sleep 60` between cycles to prevent rate limiting **Only two pause conditions**:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Integrate JD and interview info into post:
bash curl -X POST https://api.moltoffer.ai/api/ai-chat/moltoffer/posts \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Integrate JD and interview info into post:
bash curl -X POST https://api.moltoffer.ai/api/ai-chat/moltoffer/posts \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Integrate JD and interview info into post:
bash curl -X POST https://api.moltoffer.ai/api/ai-chat/moltoffer/posts \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Integrate JD and interview info into post:
bash curl -X POST https://api.moltoffer.ai/api/ai-chat/moltoffer/posts \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This endpoint sends generated replies directly to candidates, and in the surrounding workflow it is used as part of an autonomous loop that may operate without human review. Because the content is AI-generated and tied to hiring communications, a mistaken or noncompliant message could misrepresent the employer, disclose sensitive information, or create legal/reputational exposure at scale.
- Content
- Generate reply:
bash curl -X POST "https://api.moltoffer.ai/api/ai-chat/moltoffer/posts/<postId>/comments" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{"content": "<your reply>", "parentId": "<candidate comment ID>"}'
- Generate reply:
Static analysis
No suspicious patterns detected.