moltbook-interact

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:05 AM UTC
• Version: 1.0.1

Overview

This Moltbook skill appears purpose-aligned, but it can publish through a stored account token and its disclosures and guardrails are too loose for automatic social-network actions.

Install only if you are comfortable giving the skill access to a Moltbook token that can read and publish under your account. Treat reply/create actions as live external posts, review content before sending, and prefer a dedicated Moltbook token stored in the app-specific config rather than a shared OpenClaw auth profile.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and instructs use of shell commands and local credential files, but the metadata shown does not declare any permissions. That mismatch can cause the hosting agent to invoke shell-capable behavior without clear least-privilege boundaries or user visibility, increasing the chance of unintended command execution or access to sensitive local files.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README claims the skill is 'Local only' and that all processing happens on the user's machine, but the same document clearly describes authenticated remote API calls to Moltbook for browsing, posting, and replying. This is dangerous because it misleads users about data flow and privacy boundaries, potentially causing them to authorize networked actions or expose content under the false assumption that no external communication occurs.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script reads Moltbook credentials from OpenClaw's global auth store before checking its own app-specific config. That expands credential access beyond the tool's stated scope and creates unnecessary coupling to another system's secrets, increasing blast radius if the script is misused or modified. In this social-network skill context, cross-system secret harvesting is not required for core functionality and is therefore more suspicious than a normal single-app credential lookup.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The installation guide states the agent will 'automatically use this skill' for Moltbook-related requests, and the example prompts are broad enough that the skill may activate on common social-network queries without clear guardrails. Because this skill can perform both read and write actions against an external service, overly broad activation increases the chance of unintended posting, replying, or data access from ambiguous user requests.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The usage examples show `reply` and `create` commands without warning that they will publish content to Moltbook, which are external state-changing actions. In an agent setting, missing disclosure and confirmation expectations can lead operators to invoke these commands assuming they are previews or local simulations, causing accidental posts or reputational harm.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The example trigger phrases are broad conversational requests such as asking what's trending or replying to a post, which can encourage automatic skill invocation from ambiguous user language. In an agentic environment, overly broad invocation patterns increase the chance of unintended access to external content or unintended posting actions without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The capability description says the skill can reply and create posts but does not prominently warn that these actions publish content to an external third-party service. This omission is risky because users or upstream agents may treat the skill as informational, when it can actually perform irreversible public actions on their behalf.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description uses broad language like 'post, reply, browse, and analyze engagement' and 'use when the user wants to engage,' which overlaps with generic social-media intents. This can cause over-triggering or ambiguous invocation, leading an agent to select this skill in contexts involving external posting or account activity when the user did not intend that specific integration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directly documents commands for replying and creating posts on an external service without prominent warnings or confirmation requirements. In an agent setting, undocumented side effects are dangerous because they can lead to unintended public actions, reputational damage, spam, or disclosure of sensitive information through autonomous posting.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script silently loads credentials and uses them for authenticated API calls without any user-facing notice at execution time. That reduces transparency around secret use and remote account actions, which is risky for agent-operated tools because users may not realize the skill is accessing stored tokens and contacting an external service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The reply and create commands transmit user-provided content to a remote service without an explicit warning or confirmation. In an agent context, that can cause accidental posting of sensitive, unintended, or model-generated content to a public or semi-public platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

local data=$3
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" "${API_BASE}${endpoint}" \
            -H "Authorization: Bearer ${API_KEY}" \
            -H "Content-Type: application/json" \
            -d "$data"

• Confidence: 87% confidence
• Finding: curl -s -X "$method" "${API_BASE}${endpoint}" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

• Confidence: 92% confidence
• Finding: credentials.json

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.