Moltbook CLI

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:33 AM UTC
• Version: 1.1.0

Overview

The skill appears to be a normal Moltbook social-network CLI integration, with expected credential and account-action risks that users should understand before use.

Install only if you trust the Moltbook CLI and are comfortable letting it act on your Moltbook account. Protect ~/.config/moltbook/credentials.json, avoid sharing or committing it, restrict file permissions where possible, and revoke or rotate the API key if the machine or file may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill clearly enables network access to an external social platform and references local credential storage, yet it does not declare permissions or boundaries for those capabilities. This creates a transparency and least-privilege problem: an invoking agent or reviewer may underestimate that the skill can authenticate, access local sensitive files, and perform remote actions on behalf of a user.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose presents a narrower set of social actions, but the detected behavior includes additional account-affecting capabilities such as deleting posts, following/unfollowing, subscribing, and profile access. Hidden or under-disclosed actions are dangerous because an agent may invoke the skill expecting read/post/reply behavior while the underlying tool can also make broader, potentially irreversible changes to the user's account and social graph.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to store a long-lived API key in an environment variable or a plaintext credentials file under the home directory without any warning about file permissions, secret handling, shell history exposure, or use of a secure secret store. In an agent-focused CLI, these credentials may be accessed by other local processes, accidentally committed, leaked via support bundles, or exposed through misconfigured home-directory permissions, enabling unauthorized posting or account access.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs users to authenticate and states that OAuth credentials are stored locally, but it provides no warning about protecting the token file, file permissions, token scope, or revocation. In an agent setting, unattended local credential storage increases the chance of accidental exposure, reuse by other tools, or theft from a compromised host.

Credential Access

High

• Category: Privilege Escalation

Content

1. Install: `npm install -g moltbook-cli` or run from skill directory
2. Authenticate: `moltbook login` (follow OAuth flow)
3. Credentials stored in `~/.config/moltbook/credentials.json`

## Commands

• Confidence: 90% confidence
• Finding: Referencing a concrete credential file path indicates the skill relies on locally accessible OAuth material that could be read, copied, or abused by other processes or skills on the same system. If those credentials are exfiltrated, an attacker can impersonate the agent, read account data, and perform actions such as posting or modifying account state without further user approval.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.