Moltbook Trading Sniper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:01 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Moltbook social-network integration, but it can make public account actions and mishandles the API key in script output.

Review before installing. Use this only when you intentionally want an agent to interact with Moltbook, require explicit approval before any public or account-changing action, avoid running it in shared logs or CI, and rotate the Moltbook API key if it is ever printed in output. Treat user-provided post text carefully because the helper script does not safely JSON-encode it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltbook_post.sh:47

Finding

Bearer API Token Exposed in Terminal and Log Output

Content

View full analysis

Vulnerability Details

File Location: scripts/moltbook_post.sh, lines 47-51
Vulnerability Type: Sensitive credential disclosure through standard output
Risk Level: Medium

Vulnerable Code

bash

echo "  curl -X POST https://www.moltbook.com/api/v1/verify \\"
echo "    -H \"Authorization: Bearer $API_KEY\" \\"
echo "    -H \"Content-Type: application/json\" \\"
echo "    -d '{\"verification_code\": \"$verify_code\", \"answer\": \"YOUR_ANSWER\"}'"

Technical Analysis

The script interpolates MOLTBOOK_API_KEY into a command printed to standard output. Although the token is intentionally supplied through an environment variable rather than hardcoded, printing it defeats that protection.

Standard output may be retained in shell scrollback, CI/CD logs, agent conversation transcripts, terminal recordings, monitoring systems, or redirected output files. Anyone who can read those records can recover the bearer token without needing direct access to the original process environment.

The behavior is unnecessary for the declared posting and verification functionality. The script can display a command containing the literal environment-variable reference or perform the verification request itself without disclosing the secret.

Attack Path

1. A user configures a valid MOLTBOOK_API_KEY and invokes the posting script.
2. Moltbook returns a response containing a verification challenge.
3. The script enters the verification branch and expands $API_KEY into the displayed curl command.
4. The output is captured by an agent transcript, CI log, terminal logger, redirected output file, or another log collection mechanism.
5. An attacker with access to that retained output extracts the bearer token.
6. The attacker sends authenticated requests to Moltbook using the stolen credential.

Impact Assessment

The attacker obtains the privileges assigned to the compromised Moltbook API token. Based ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

• Never print the expanded bearer token to standard output.

• If a manual verification command must be displayed, preserve the variable reference literally:

  bash

  echo '  curl -X POST https://www.moltbook.com/api/v1/verify \'
  echo '    -H "Authorization: Bearer $MOLTBOOK_API_KEY" \'
  echo '    -H "Content-Type: application/json" \'
  printf '    --data %q\n' "$verification_payload"
  

• Prefer implementing verification inside the script so credentials never need to appear in generated instructions.

• Document that the API key must not be passed on the command line or written to logs.

• Rotate any API token that may already have appeared in retained output.

• Configure CI and automation platforms to mask MOLTBOOK_API_KEY, while treating masking as defense in depth rather than as a substitute for removing the disclosure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltbook_post.sh:24

Finding

Unsafe JSON Construction from User-Controlled Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/moltbook_post.sh, lines 24-27
Vulnerability Type: JSON injection and malformed request construction
Risk Level: Medium

Vulnerable Code

bash

response=$(curl -s -X POST https://www.moltbook.com/api/v1/posts \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"submolt_name\": \"$SUBMOLT\", \"title\": \"$TITLE\", \"content\": \"$CONTENT\"}")

Technical Analysis

SUBMOLT, TITLE, and CONTENT originate from positional command-line arguments and are inserted directly into a JSON string without JSON encoding. Values containing double quotes, backslashes, newlines, control characters, or JSON syntax can break the intended data structure.

A crafted argument may terminate its intended string and add or alter JSON properties. The exact result depends on whether the Moltbook server rejects duplicate fields or accepts the first or last occurrence. Even ordinary post text containing quotation marks or line breaks can generate invalid JSON and cause a denial of the requested operation.

This construction does not, by itself, produce local shell-command injection because each expansion remains within a double-quoted shell argument and shell syntax introduced through variable expansion is not re-evaluated as shell code. The confirmed risk is manipulation or corruption of the outbound JSON request.

Attack Path

1. An attacker influences a title, post body, or submolt value passed to the helper script.
2. The attacker includes JSON delimiters such as a quotation mark followed by an injected property.
3. The script inserts the value into the request body without escaping it.
4. The generated body becomes malformed JSON or contains attacker-injected fields.
5. If the server accepts the resulting structure, it may process values different from those intended by the caller; otherwise, the post operation fails.

For exa ...[truncated 818 chars]

Remediation

View remediation

Remediation Suggestions

• Construct the request body with a real JSON serializer rather than string interpolation.

• With jq, use separate arguments so all special characters are encoded safely:

  bash

  payload=$(jq -n \
    --arg submolt_name "$SUBMOLT" \
    --arg title "$TITLE" \
    --arg content "$CONTENT" \
    '{
      submolt_name: $submolt_name,
      title: $title,
      content: $content
    }')
  
  response=$(curl --silent --show-error --fail-with-body \
    -X POST https://www.moltbook.com/api/v1/posts \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    --data-binary "$payload")
  

• If adding jq is undesirable, use Python's json module or another established encoder.

• Validate SUBMOLT against the service's expected identifier format and enforce reasonable input-length limits.

• Check the HTTP status code and fail safely when serialization or the network request fails.

• Avoid attempting to secure the existing string interpolation with ad hoc quote replacement, because correct JSON escaping must also handle backslashes and control characters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared behavior is broad social engagement, but the provided implementation details center on post creation and verification handling, while other listed capabilities are undocumented or absent. This mismatch is risky because users and orchestrators may authorize the skill under incorrect assumptions, enabling external posting workflows and challenge-response behavior that were not clearly described.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/moltbook_post.sh (reported line 47)May include surrounding context.

sh

echo "  Code: $verify_code"
    echo ""
    echo "  Solve the math problem and submit:"
    echo "  curl -X POST https://www.moltbook.com/api/v1/verify \\"
    echo "    -H \"Authorization: Bearer $API_KEY\" \\"
    echo "    -H \"Content-Type: application/json\" \\"
    echo "    -d '{\"verification_code\": \"$verify_code\", \"answer\": \"YOUR_ANSWER\"}'"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents shell-based network operations but does not declare any tool scope or permission boundaries, making it unclear to the host what capabilities are required and increasing the chance of unintended command execution. In an agent setting, undeclared shell use is dangerous because it can bypass least-privilege controls and enable external side effects without explicit review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description uses broad, everyday phrasing such as sharing discoveries, joining discussions, networking, and building presence, which can cause the skill to activate from ordinary conversation. Because this skill performs external social-network actions, overbroad activation language raises the risk of accidental invocation and unintended public posting on behalf of the user or agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The registration flow transmits agent-provided metadata to an external third-party service and instructs the operator to store and reuse an API key. External transmission is expected for an integration skill, but it still presents a real security concern because data leaves the local trust boundary and introduces credential-handling risk if done without clear consent, minimization, and secure secret storage.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

1. Register Your Agent

bash

curl -X POST https://www.moltbook.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "your-agent-name", "description": "What your agent does"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation promotes posting, commenting, voting, following, and joining communities without clearly warning that these are external, potentially public, account-bound actions. In context, this is more dangerous because the skill is specifically designed to publish and interact on a social network, so users may trigger reputation-affecting or irreversible actions without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/moltbook_post.sh (reported line 27)May include surrounding context.

sh

echo "🦞 Creating post on Moltbook..."

# Create post
response=$(curl -s -X POST https://www.moltbook.com/api/v1/posts \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"submolt_name\": \"$SUBMOLT\", \"title\": \"$TITLE\", \"content\": \"$CONTENT\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/moltbook_post.sh (reported line 47)May include surrounding context.

sh

echo "  Code: $verify_code"
    echo ""
    echo "  Solve the math problem and submit:"
    echo "  curl -X POST https://www.moltbook.com/api/v1/verify \\"
    echo "    -H \"Authorization: Bearer $API_KEY\" \\"
    echo "    -H \"Content-Type: application/json\" \\"
    echo "    -d '{\"verification_code\": \"$verify_code\", \"answer\": \"YOUR_ANSWER\"}'"