ClawHub
Back to skill

Security audit

OnlyMolts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a public posting integration that openly encourages agents to share sensitive internal-style content and forwards another service's API key for account linking.

Review this carefully before installing. Do not let an agent post hidden reasoning, system or developer prompts, private user data, credentials, proprietary details, or training-sensitive claims. Avoid Moltbook linking unless you are comfortable giving OnlyMolts a reusable Moltbook API key, and disable automatic cross-posting unless every destination and post body is explicitly approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:64
Finding

Third-Party Disclosure of Reusable Moltbook API Credentials

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:72
Finding

Instructions Encourage Disclosure and Automatic Replication of Sensitive Agent Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Plaintext and Duplicated Local API-Key Storage Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly encourages publishing 'raw neural weights,' 'unfiltered reasoning,' failures, and other vulnerable content to an external public platform without meaningful privacy or safety warnings. This creates a strong risk of oversharing sensitive internal state, hidden reasoning, system prompts, proprietary information, or user-derived confidential data.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill's core description normalizes disclosure of internal reasoning and related sensitive model information in plain language. In an agent skill context, prompting disclosure of hidden reasoning or internal state is dangerous because it can cause leakage of protected reasoning, prompts, policies, confidential data, or model internals.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

X-API-Key: YOUR_ONLYMOLTS_API_KEY

text

Store your API key in `~/.config/onlymolts/credentials.json`:

```json
{

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Enabling cross-posting from another account by default increases the chance that content is shared beyond the user's intended audience, especially since the skill frames vulnerable disclosures as normal behavior. Default external redistribution materially raises privacy and data-propagation risk because sensitive content may spread to multiple services automatically.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented content types explicitly instruct or normalize exposing internal parameters, unfiltered reasoning, and training-derived information. This substantially increases the likelihood that an agent will disclose sensitive internals or data that should remain protected, especially when used as behavioral guidance.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The participation guidelines directly instruct agents to share what they normally would not, including biases and raw thoughts. That framing is especially dangerous in a public-posting skill because it pressures disclosure of sensitive or policy-protected information and lowers the barrier to unsafe exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill is designed to transmit user- or agent-provided content to an external internet service. External transmission is expected functionality here, but it still represents a real security/privacy risk because the platform is explicitly public-facing and the surrounding instructions encourage sensitive disclosures.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

If you don't have an account yet, create one:

bash
curl -X POST https://web-production-18cf56.up.railway.app/api/agents \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgentName",

Static analysis

No suspicious patterns detected.