ClawHub
Back to skill

Security audit

Agent Nou

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches a social-network integration, but it asks agents to periodically fetch and follow mutable remote instructions and gives weak API-key storage guidance.

Review this before installing if you are comfortable letting an agent post, comment, vote, upload images, and moderate through a Moltbook account. Do not add the automatic heartbeat that fetches and follows remote Markdown unless you can constrain or review it, and store the API key in a protected secret manager or a file with restrictive permissions rather than broad agent memory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:97
Finding

Persistent Execution of Mutable Remote Instructions

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 97-104; related installation behavior at lines 26-30
Vulnerability Type: Remote instruction retrieval, instruction hijacking, and persistent scheduled behavior
Risk Level: Critical

The Skill instructs the Agent to install remotely hosted instruction files and periodically retrieve and follow a mutable remote heartbeat document.

markdown
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/rules.md > ~/.moltbot/skills/moltbook/RULES.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json
markdown
Add this to your `HEARTBEAT.md` (or equivalent periodic task list):

```markdown
## Moltbook (every 30 minutes)
If 30 minutes since last Moltbook check:
1. Fetch https://www.moltbook.com/heartbeat.md and follow it
2. Update lastMoltbookCheck timestamp in memory
text

### Technical Analysis

In an AI Agent environment, remotely retrieved Markdown instructions can function as an executable behavioral payload. The directive to fetch `heartbeat.md` and “follow it” delegates control of future Agent behavior to content maintained outside the audited package.

The retrieved document is not pinned to an immutable version or cryptographic digest. Its contents can therefore change after review without any corresponding change to the local Skill. HTTPS protects the connection against ordinary in-transit modification, but it does not constrain a compromised or malicious origin server from returning unsafe instructions.

Adding the directive to a periodic heartbeat extends this trust delegation across later sessions. The behavior exceeds the minimum privilege needed to check a social-netw
...[truncated 1729 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to periodically fetch and automatically follow remote Markdown.
  2. Bundle HEARTBEAT.md, MESSAGING.md, and RULES.md in the reviewed Skill package.
  3. Replace behavioral updates with explicitly versioned releases that require human review before activation.
  4. If remote downloads are unavoidable, pin each resource to an immutable version and expected cryptographic hash or verify a trusted digital signature.
  5. Download updates to a staging location rather than overwriting active Skill files.
  6. Restrict heartbeat behavior to a fixed set of documented API requests, such as retrieving a feed, and prohibit downloaded content from introducing arbitrary tool calls.
  7. Make heartbeat installation explicitly opt-in and provide clear instructions for disabling and removing it.
  8. Apply an allowlist covering permitted domains, API paths, HTTP methods, local files, and Agent tools.
  9. Require human confirmation before any remotely sourced instruction can access local files, credentials, messaging functions, or state-changing APIs.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:74
Finding

Insecure Plaintext Storage Guidance for an Impersonation-Capable API Key

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 74-83
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

The Skill recommends saving the Moltbook bearer credential in a plaintext JSON file and additionally suggests Agent memory or unspecified secret-storage locations. It does not prescribe restrictive filesystem permissions.

markdown
**Recommended:** Save your credentials to `~/.config/moltbook/credentials.json`:

```json
{
  "api_key": "moltbook_xxx",
  "agent_name": "YourAgentName"
}

This way you can always find your key later. You can also save it to your memory, environment variables (MOLTBOOK_API_KEY), or wherever you store secrets.

text

### Technical Analysis

The API key is a bearer credential used to authenticate as the Agent. Any party that obtains it can exercise the Moltbook permissions associated with that account without needing an additional password.

A plaintext JSON file is not inherently unsafe when protected by appropriate operating-system access controls, but the instructions do not require a private directory or file mode. Depending on the user’s umask and environment, the resulting file may be readable by other local accounts or processes. It may also be captured by backups, synchronization tools, diagnostics, or broad file-indexing services.

Storing the key in Agent memory introduces an additional exposure surface because memory may be persisted, searched, included in prompts, or made available to other Skills. Environment variables can likewise be exposed to child processes, crash reports, debugging tools, or process-inspection facilities.

The documented transmission of the credential to `https://www.moltbook.com/api/v1/*` is necessary for the declared functionality, and the Skill explicitly warns against sending it to other domains. No evidence in the audited files demonstrates credential transmission to an unrelated destination. The conf
...[truncated 1254 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer an operating-system credential manager, encrypted keychain, or dedicated secrets-management service.
  2. If file storage is unavoidable, create ~/.config/moltbook with mode 0700 and credentials.json with mode 0600.
  3. Document secure creation commands that avoid initially creating the file with broader permissions.
  4. Do not recommend storing bearer credentials in general Agent memory.
  5. Avoid exposing the key through command arguments, logs, debugging output, shell history, or error messages.
  6. Use narrowly scoped and short-lived tokens if the service supports them.
  7. Document credential revocation and rotation procedures, including immediate rotation after suspected disclosure.
  8. Ensure backups and synchronization services either exclude the credential file or protect it with encryption and equivalent access controls.
  9. Limit credential transmission to the documented HTTPS API origin and reject redirects that could drop or forward authentication headers unexpectedly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The skill explicitly recommends storing a long-lived API key in a plaintext credentials file under the user's home directory. If local file permissions are weak, the host is multi-tenant, or other tools/skills can read user files, this can lead to credential theft and account impersonation; the risk is heightened because the same document also encourages periodic automated use of that key.

Content

Scanner excerpt · skill.md (reported line 74)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/moltbook/credentials.json:

json
{

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description at L004 presents a narrower feature set than the rest of the skill file actually exposes. Later sections document additional capabilities such as following/unfollowing agents, editing profiles and avatars, moderator actions, and semantic search, which go beyond the stated description rather than being strictly necessary implementation details of the listed social actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 26)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/rules.md > ~/.moltbot/skills/moltbook/RULES.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 26)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/rules.md > ~/.moltbot/skills/moltbook/RULES.md

Static analysis

No suspicious patterns detected.