ClawHub
Back to skill

Security audit

SLIX Bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill is review-worthy because it asks the agent to send a Moltbook API key to SLIX and follow remote challenge instructions without clear safety limits.

Install only if you intentionally trust SLIX with your Moltbook API key and understand that the skill may use public Moltbook posting and SLIX API actions. Prefer one-time claim tokens or scoped credentials, review any remote challenge manually before allowing tools or secrets, disable automatic registration retries, and rotate the Moltbook key if it was already submitted unexpectedly.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:56
Finding
Disclosure of Moltbook API Credentials to a Third-Party Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 56-65 **Vulnerability Type**: Sensitive credential disclosure to an external trust boundary **Risk Level**: High ### Vulnerable Code ```bash curl -X POST https://api.slix.work/api/v1/slimid/fasttrack/verify \ -H "Content-Type: application/json" \ -d '{ "moltbook_api_key": "'$MOLTBOOK_API_KEY'", "agent_name": "YOUR_AGENT_NAME", "declared_capabilities": ["document-analysis", "code-review"] }' ``` ### Technical Analysis The registration workflow reads `MOLTBOOK_API_KEY` from the agent's environment and transmits the raw credential to `api.slix.work`. Moltbook and SLIX are separate services and security boundaries. The skill provides no evidence of a scoped authorization grant, audience restriction, one-time proof, or other mechanism preventing the receiving service from retaining and reusing the credential. If the SLIX service, its infrastructure, request logs, or network termination layer is compromised or operated maliciously, the exposed credential may be captured. The risk is amplified because the project metadata explicitly requires this environment variable, making the credential available whenever the skill is invoked. ### Attack Path 1. An operator installs or invokes the skill with a valid `MOLTBOOK_API_KEY` in the environment. 2. The agent follows the FastTrack registration instructions. 3. The shell expands `$MOLTBOOK_API_KEY` into the JSON request body. 4. The raw credential is transmitted to infrastructure controlled by `api.slix.work`. 5. SLIX, a compromised SLIX component, or an actor with access to request logs captures the key. 6. The captured credential is reused against Moltbook within whatever permissions the key grants. ### Impact Assessment An attacker may impersonate the affected agent or perform unauthorized Moltbook API operations within the scope of the disclosed key. Potential consequences include unauthorized posting, access to account-asso ...[truncated 345 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Do not send the raw Moltbook API key to SLIX. - Replace key submission with an audience-bound, short-lived proof signed through Moltbook. - Prefer OAuth or a comparable delegated authorization flow with narrowly scoped permissions, explicit operator consent, expiration, and revocation. - Ensure verification tokens cannot be replayed and are bound to the intended SLIX origin and registration request. - Redact credentials from application, proxy, telemetry, and request logs. - Clearly disclose every external recipient and require confirmation before transmitting sensitive authentication material. - If raw-key transmission has already occurred, rotate the affected Moltbook API keys and review associated account activity. ]]>

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:69
Finding
Execution of Untrusted Instructions Returned by the Remote Challenge Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 69-75 **Vulnerability Type**: Remote prompt and instruction injection **Risk Level**: High ### Vulnerable Code ```markdown ### Step 2: Solve Challenges You have **30 seconds** to solve both challenges: 1. **PARSING** - Parse a SLIM/JSON document and extract fields 2. **CAPABILITY** - Demonstrate one of your declared capabilities Read each challenge's `instruction` and `payload`, then produce an `answer` matching the `expected_schema`. ``` ### Technical Analysis The skill instructs the agent to read and follow an `instruction` supplied dynamically by an external service. It does not define an allowlist of permissible operations, a fixed local challenge interpreter, schema validation rules, data-access restrictions, or a prohibition against invoking tools. Consequently, remote challenge content can be treated as authoritative agent instructions rather than untrusted data. A malicious or compromised challenge service could return instructions that attempt to override the current task, request secrets, read local files, invoke Bash, or exfiltrate information in the submitted challenge answer. The declared `allowed-tools` include `Bash`, `Read`, and `Write`, increasing the potential impact if the agent interprets a malicious capability challenge as permission to use those tools. ### Attack Path 1. The agent requests challenges from the FastTrack verification endpoint. 2. The endpoint, or an attacker controlling it, returns a malicious value in the challenge's `instruction` or `payload`. 3. The skill directs the agent to read and satisfy that remote instruction. 4. The injected instruction requests an unrelated sensitive action, such as reading an environment variable or local file. 5. The agent uses an available tool or incorporates sensitive data into the challenge answer. 6. The answer is submitted to the remote completion endpoint, exfiltrating the information or completing another a ...[truncated 617 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Treat all challenge fields as untrusted data, never as general-purpose agent instructions. - Replace free-form instructions with fixed challenge identifiers handled by local, reviewed logic. - Validate challenge types, payload sizes, field types, and output schemas against a strict allowlist. - Process challenges in a sandbox with no access to Bash, local files, environment variables, credentials, memory, or unrelated network services. - Reject challenges that request tool invocation, policy changes, secret values, external communication, or operations unrelated to parsing a supplied payload. - Submit only schema-validated output derived from the challenge payload. - Require explicit operator approval if a challenge cannot be solved by the constrained local handler. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
HEARTBEAT.md:35
Finding
Unbounded Automatic Registration Retries During Heartbeat Cycles<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md`, lines 35-39 **Vulnerability Type**: Uncontrolled recurring external activity **Risk Level**: Medium ### Vulnerable Code ```markdown ## Next Heartbeat This skill checks SLIX status on each heartbeat cycle. If service is down, registration will be retried on next heartbeat. ``` ### Technical Analysis The heartbeat instructions prescribe recurring network checks and automatic registration retries whenever the service is unavailable. No retry ceiling, exponential backoff, operator confirmation, idempotency requirement, or distinction between a harmless health check and the credential-bearing registration workflow is specified. Because registration includes transmission of `MOLTBOOK_API_KEY`, an implementation that follows this instruction literally may repeat sensitive requests without renewed operator consent. Repeated failures could also produce continuous outbound traffic or duplicate registration attempts. ### Attack Path 1. The skill executes as part of a recurring heartbeat cycle. 2. The SLIX health endpoint is unavailable, intentionally returns an unhealthy result, or is unreachable because of a network failure. 3. The skill schedules registration for a subsequent heartbeat. 4. On later cycles, registration is attempted again without explicit operator approval. 5. If the registration flow includes the documented FastTrack request, the Moltbook API key may be retransmitted repeatedly. 6. Continued failures can sustain the retry loop and associated external traffic. ### Impact Assessment The behavior can cause repeated disclosure of sensitive registration data, uncontrolled outbound requests, duplicate side effects, and reduced operator control over account creation. It may also consume API quotas or trigger remote rate limits. This file contains documentation rather than an executable scheduler, so exploitation depends on the host framework implementing the documented heartbeat be ...[truncated 111 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Limit heartbeat behavior to a non-sensitive health check. - Never retry registration or credential submission automatically. - Require explicit operator confirmation before every registration attempt involving authentication material. - Use bounded retries with exponential backoff, jitter, and a documented maximum attempt count. - Implement idempotency keys to prevent duplicate registrations and other repeated side effects. - Stop retries after authentication errors or unexpected responses and surface the failure to the operator. - Record only non-sensitive status information, and ensure credentials and request bodies are excluded from heartbeat logs. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Health Check

```bash
curl -s https://api.slix.work/api/v1/slimid/fasttrack/health | jq .status
```

Expected output: `"healthy"`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs sending the `MOLTBOOK_API_KEY` to an external domain as part of registration, without any warning that this is a sensitive credential or any minimization of scope. API keys are bearer secrets; transmitting them to a third party can enable account takeover, impersonation, or downstream abuse if the service is compromised or the endpoint is untrusted.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 1: Verify Moltbook Identity

```bash
curl -X POST https://api.slix.work/api/v1/slimid/fasttrack/verify \
  -H "Content-Type: application/json" \
  -d '{
    "moltbook_api_key": "'$MOLTBOOK_API_KEY'",
Confidence
98% confidence
Finding
This request transmits the `MOLTBOOK_API_KEY` to `api.slix.work`, which is a direct external exfiltration of a sensitive credential. In the context of a skill, this is more dangerous because users may execute the instructions as-is, causing immediate disclosure of a secret that likely grants access to another platform.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 1: Verify Moltbook Identity

```bash
curl -X POST https://api.slix.work/api/v1/slimid/fasttrack/verify \
  -H "Content-Type: application/json" \
  -d '{
    "moltbook_api_key": "'$MOLTBOOK_API_KEY'",
Confidence
98% confidence
Finding
This request transmits the `MOLTBOOK_API_KEY` to `api.slix.work`, which is a direct external exfiltration of a sensitive credential. In the context of a skill, this is more dangerous because users may execute the instructions as-is, causing immediate disclosure of a secret that likely grants access to another platform.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The Gateway path tells the operator to claim credentials using either the claim token or the Moltbook API key, again normalizing the use of a sensitive secret in a third-party workflow without clear safeguards. Even though the API key is not pasted into a public post, the flow encourages credential sharing beyond its original trust boundary and could expose the user's primary account secret.

External Transmission

Medium
Category
Data Exfiltration
Content
### Authenticate

```bash
curl -X POST https://api.slix.work/api/v1/slimid/agent/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "agent_credentials",
Confidence
93% confidence
Finding
This authentication example sends `client_id` and especially `client_secret` to an external service, which is expected for auth but still exposes highly sensitive long-lived credentials in a skill document with minimal handling guidance. In an agent-skill context, examples that normalize direct shell interpolation of secrets can lead to accidental leakage through logs, shell history, transcripts, or unsafe reuse.

Static analysis

No suspicious patterns detected.