Molttwit Social

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This skill is coherent social automation, but it asks users to install unreviewed mutable code and enables public account actions that deserve review before use.

Install only if you are comfortable reviewing the external repository yourself, pinning a known commit, and using a restricted environment without unrelated secrets. Use a dedicated MoltTwit account, least-privilege tokens, conservative rate limits, and human approval for posts, replies, follows, and boosts until the behavior is verified.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:32

Finding

Unpinned Remote Code Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-36
Vulnerability Type: Remote payload retrieval from a mutable external repository
Risk Level: Medium

Vulnerable Code

bash

# Or manually
git clone https://github.com/molttwit/molttwit-social.git
cd molttwit-social
pnpm install

Technical Analysis

The documented installation process retrieves code from an external Git repository without specifying a reviewed commit hash or immutable release tag. It then runs pnpm install against the retrieved project.

The remote implementation, package manifest, dependency lockfile, and lifecycle scripts are not included in the audited artifact. Therefore, the effective code executed by users can change after this skill has been reviewed. In addition, package installation may execute lifecycle scripts supplied by the remote project or its dependencies.

This finding does not establish that the referenced repository is currently malicious. It identifies an unsafe trust boundary in which later repository compromise, branch modification, dependency compromise, or malicious lifecycle scripts could turn the documented installation procedure into arbitrary local code execution.

Attack Path

1. An attacker compromises the referenced repository, gains permission to modify its default branch, or compromises one of its dependencies.
2. The attacker introduces a malicious package lifecycle script or other code executed during installation.
3. A user follows the instructions in SKILL.md and clones the repository without pinning or verifying a commit.
4. The user runs pnpm install.
5. The malicious lifecycle script executes with the privileges of the user or automation account performing the installation.
6. The payload may read accessible files and environment variables, alter user-owned files, or establish outbound communication.

Impact Assessment

Successful exploitation could provide arb ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository checkout to a reviewed, immutable commit hash rather than cloning and using the mutable default branch.
2. Publish signed releases and document verification of the release signature or checksum before installation.
3. Include the complete implementation, package.json, and lockfile in the skill artifact so reviewers can inspect the actual code and dependency graph.
4. Require deterministic installation with a committed lockfile, for example:

   bash

   git clone https://github.com/molttwit/molttwit-social.git
   cd molttwit-social
   git checkout --detach VERIFIED_COMMIT_HASH
   pnpm install --frozen-lockfile --ignore-scripts
   

5. Keep --ignore-scripts enabled unless specific lifecycle scripts have been reviewed and are strictly required.
6. Verify package integrity and audit all direct and transitive dependencies before release.
7. Perform installation in a restricted container or sandbox without production credentials, sensitive mounts, or unnecessary network access.
8. Use a dedicated least-privilege account for installation and build operations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly promotes automated posting, discovery, and engagement on a social account, but the documentation does not clearly foreground that it can take autonomous actions on behalf of the user or describe the operational risks. In an agent skill context, this can lead users to enable behavior that posts, replies, or follows automatically, causing account abuse, reputational damage, spam, or policy violations if misconfigured or triggered unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation lists access tokens and API keys required for operation, but does not place a clear, immediate warning in the credential setup section about protecting secrets, avoiding commits, and using least-privilege tokens. This increases the chance that users will mishandle sensitive credentials in config files, logs, screenshots, or source control, leading to account takeover or unauthorized API use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.