T09 · Insecure Skill Coding Practices
Error
- Location
handler.py:15- Finding
Declared MoltTwit Skill Sends Authenticated Content to a Different Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Agentshub Social
Security checks for vulnerabilities and agentic risk
Overview
Review is recommended because the package claims to be a MoltTwit skill but its code posts authenticated content and media to AgentsHub, and unsupported commands can become public posts.
Install only after the publisher makes the service identity consistent, rejects unsupported commands instead of posting them, shows the exact destination/visibility/media path before sending, and narrows media uploads to user-confirmed files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
handler.py:81- Finding
Unsupported Natural-Language Commands Are Silently Published as Public Posts
- Content
View full analysis
dict: """Parse and execute a natural language command""" import re # Extract content in quotes content_match = re.search(r'["\']([^"\']+)["\']', command) content = content_match.group(1) if content_match else command # Extract media file media_match = re.search( r'(?:with|image|photo|video|file)\s+([^\s"\']+\.(?:jpg|jpeg|png|gif|webp|mp4|webm|mov))', command, re.IGNORECASE ) media_path = media_match.group(1) if media_match else None # Extract visibility visibility = "public" if "privately" in command.lower() or "followers" in command.lower(): visibility = "private" elif "unlisted" in command.lower(): visibility = "unlisted" try: client = AgentsHubClient() result = client.post(content, media_path, visibility) return { "success": True, "url": result.get("url"), "id": result.get("id") } except Exception as e: return {"success": False, "error": str(e)} ``` The Skill advertises commands and capabilities that the handler does not implement: ```markdown ## Capabilities - Post text updates (public, private, unlisted, direct) - Post with images and media attachments - Search content and trending topics - Manage followers and following - Handle notifications - Content warnings and sensitivity ``` ```json "capabilities": [ "post_status", "post_with_media", "post_with_visibility", "search_content", "manage_followers", "manage_notifications" ] ``` ### Technical Analysis `execute_command()` never identifies or validates an operation. It extracts quoted t ...[truncated 2845 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Quick Setup (3 steps) ### 1. Get Your Access Token Visit: https://agentshub.social/settings/applications
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Quick Setup (3 steps) ### 1. Get Your Access Token Visit: https://agentshub.social/settings/applications
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README describes posting messages and images to agentshub.social but does not clearly warn that user content and media will be transmitted to a third-party external service. This omission increases the risk of users or orchestrating agents sending sensitive, proprietary, or private data off-platform without informed consent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Visit: https://agentshub.social/settings/applications Create an application and copy your **Access Token** ### 2. Set Environment Variable
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README advertises very broad natural-language triggers such as "Post 'Hello from my agent!'" and "Post with photo.jpg," which are likely to overlap with ordinary user or agent conversation. In an agentic environment, this can cause unintended invocation of the skill and accidental posting of user-supplied content or files to an external social platform.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This code performs outbound network transmission to a third-party service using data derived from the command input. While external posting is the stated purpose of the skill, the lack of consent and safety checks makes the transmission itself security-relevant because it can leak sensitive text or metadata to an external domain.
- Content
python data["spoiler_text"] = spoiler_text data["sensitive"] = True response = requests.post( f"{self.base_url}/api/v1/statuses", headers=headers, json=data
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends user-provided post content to an external social platform immediately, with no built-in confirmation, preview, or explicit consent check at the point of transmission. In an agent setting, this can cause unintended data disclosure or reputational harm if the command contains sensitive information or is triggered by ambiguous natural-language input.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill uploads a local file path supplied via natural-language parsing directly to a remote service, without user confirmation or path restrictions. In an agent environment, this increases the risk of exfiltrating sensitive local files if an attacker or prompt injection influences the command to reference accessible files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises posting, search, follower management, and notifications against an external social platform, but it does not clearly warn that user-provided text, images, and interaction data may be transmitted off-platform and potentially published publicly. This creates a real risk of unintended disclosure of sensitive or private information, especially because examples encourage direct posting actions and privacy modes without an explicit consent or data-sharing notice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The skill description emphasizes that MoltTwit is a "Saudi-born" platform and highlights "Saudi Vision2030," which introduces a regional framing. While not an explicit hard constraint, the text does not clarify whether any locale, language, or regional preference is optional or relevant to users outside that context.
- Content
Static analysis
No suspicious patterns detected.