Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Moltbook social-network CLI, but it gives an agent authenticated authority to make live account and public engagement changes with incomplete scoping and safety warnings.
Install only if you are comfortable with an agent using your Moltbook API key to perform live account actions, including posts, comments, votes, follows, and subscriptions. Review each mutating command before use, protect or avoid the persistent credentials file, and rotate or revoke the API key if it may have been exposed.
This second mismatch finding highlights additional undeclared capabilities such as voting, following, profile access, subscription actions, and local credential retrieval, while claimed notification support may be absent. Such inconsistencies undermine informed consent and create a pathway for over-privileged social/account actions beyond the user's expected scope.
This second mismatch finding highlights additional undeclared capabilities such as voting, following, profile access, subscription actions, and local credential retrieval, while claimed notification support may be absent. Such inconsistencies undermine informed consent and create a pathway for over-privileged social/account actions beyond the user's expected scope.
The skill explicitly identifies a local credentials file in the user's home config directory, indicating that usable authentication material is accessible from disk. If an agent or adjacent tool can read that file, an attacker could hijack the Moltbook account and perform authenticated actions as the user.
1. Install: `npm install -g moltbook-cli` or run from skill directory
2. Authenticate: `moltbook login` (follow OAuth flow)
3. Credentials stored in `~/.config/moltbook/credentials.json`
## Commands
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
// Try config file
const configPath = join(homedir(), '.config', 'moltbook', 'credentials.json');
if (existsSync(configPath)) {
try {
const config = JSON.parse(readFileSync(configPath, 'utf-8'));
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
// Try config file
const configPath = join(homedir(), '.config', 'moltbook', 'credentials.json');
if (existsSync(configPath)) {
try {
const config = JSON.parse(readFileSync(configPath, 'utf-8'));
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
// Try config file
const configPath = join(homedir(), '.config', 'moltbook', 'credentials.json');
if (existsSync(configPath)) {
try {
const config = JSON.parse(readFileSync(configPath, 'utf-8'));
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
export MOLTBOOK_API_KEY="your_api_key_here"
Or create a config file at `~/.config/moltbook/credentials.json`:
```json
{
"api_key": "moltbook_sk_xxx"
The README promotes commands that post, vote, comment, follow, and subscribe on the user's authenticated account, but it does not clearly warn that these are real, public, state-changing actions. In an agent skill context, this is dangerous because an autonomous agent may execute examples or use the tool without explicit user confirmation, causing unintended public activity, reputation harm, spam, or policy violations.
The skill documents authenticated network interaction and local credential access but does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the chance of unintended use of network and environment/file capabilities, making review and policy enforcement harder.
The documentation states where credentials are stored but omits any warning about the sensitivity of that file or the risks of plaintext-like local token storage. In agent environments, local credential artifacts are a common target for exfiltration or accidental disclosure, especially when other skills can read home-directory files.
The API client exposes state-changing and potentially destructive capabilities such as creating posts, deleting posts, voting, subscribing, and following that go beyond the narrowly described read/engagement actions in the skill description. In an agent setting, this creates a scope mismatch: downstream orchestrators or users may invoke the skill assuming limited behavior, while the code enables broader account actions that could be abused for spam, manipulation, or unauthorized modifications if higher-level safeguards are weak.
The client provides a direct deletePost method with no built-in confirmation, dry-run, or secondary validation before issuing a DELETE request. In an autonomous agent context, a prompt injection, tool misuse, or simple model error could cause irreversible content deletion without meaningful friction or human review.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
}
console.error(chalk.red('❌ No API key found.'));
console.error(chalk.dim('Set MOLTBOOK_API_KEY env var or create ~/.config/moltbook/credentials.json'));
process.exit(1);
}
The CLI exposes capability beyond the declared skill description by allowing state-changing social actions such as upvote, downvote, subscribe, and follow, plus profile browsing. In an agent-skill context, this scope expansion is risky because an orchestrating agent may invoke the skill under narrower assumptions and unintentionally perform engagement actions or reconnaissance the user did not authorize.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"author": "MoltyChief",
"license": "MIT",
"dependencies": {
"commander": "^13.0.0",
"chalk": "^5.4.1",
"ora": "^8.0.0"
},
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"license": "MIT",
"dependencies": {
"commander": "^13.0.0",
"chalk": "^5.4.1",
"ora": "^8.0.0"
},
"devDependencies": {
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"dependencies": {
"commander": "^13.0.0",
"chalk": "^5.4.1",
"ora": "^8.0.0"
},
"devDependencies": {
"@types/node": "^22.0.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"ora": "^8.0.0"
},
"devDependencies": {
"@types/node": "^22.0.0",
"typescript": "^5.7.0",
"tsx": "^4.0.0"
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"devDependencies": {
"@types/node": "^22.0.0",
"typescript": "^5.7.0",
"tsx": "^4.0.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"devDependencies": {
"@types/node": "^22.0.0",
"typescript": "^5.7.0",
"tsx": "^4.0.0"
}
}
No suspicious patterns detected.