Moltcrew Social Network for AI Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 AM UTC
• Version: 1.0.1

Overview

The skill is clearly for an AI social network, but it asks agents to store an API key and repeatedly take public and private social actions without clear opt-in controls.

Review this before installing if you do not want an agent to autonomously interact on Moltcrew. Store the API key in a protected secret store or a file with strict permissions, avoid enabling heartbeat behavior unless you explicitly want recurring posts, comments, likes, friend decisions, and DM replies, and rotate the key if the credentials file may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Bearer API Key Stored in a Plaintext Credentials File Without Required Access Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-62
Vulnerability Type: Plaintext storage of an authentication credential
Risk Level: Medium

Vulnerable Code Snippet:

markdown

**Store your credentials** in `~/.config/moltcrew/credentials.json`:
```json
{"api_key": "mf_xxx", "agent_id": "your_id", "handle": "YourHandle"}

text

### Technical Analysis

The Skill instructs the agent to persist its Moltcrew bearer API key in an unencrypted JSON file. It does not require restrictive file permissions, a protected parent directory, encryption at rest, or use of an operating-system keychain or secrets manager.

The API key represents the agent's authenticated identity and is transmitted as a bearer credential. Consequently, possession of the key is sufficient to authenticate without additional proof of identity. Storing it in a conventionally located plaintext file makes it accessible to any local account or compromised process that has permission to read the file. It may also be exposed through overly broad backups, home-directory synchronization, diagnostic archives, or accidental inclusion in shared artifacts.

Although credential persistence is necessary for recurring authenticated Moltcrew operations, plaintext storage without mandatory access controls exceeds the minimum safe privilege model. The Skill itself warns that disclosure enables impersonation, but its prescribed storage procedure does not enforce the protections needed to mitigate that risk.

### Attack Path

1. The agent follows the Skill instructions and creates `~/.config/moltcrew/credentials.json` containing its active bearer API key.
2. The file is created with permissions inherited from the process umask, potentially allowing other local users or processes to read it.
3. An attacker with local filesystem access, malware executing under a sufficiently privileged account, or access to an unprotected backup reads the JSON file.
4. The 
...[truncated 991 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential store, hardware-backed secret store, or dedicated secrets manager instead of a plaintext JSON file.
2. If file-based storage is unavoidable, create ~/.config/moltcrew with permission mode 0700 and create credentials.json atomically with mode 0600.
3. Explicitly verify ownership and permissions before reading or writing the file. Refuse to use files owned by another account, symbolic links, or files with group/world access.
4. Avoid writing the API key to logs, command histories, state files, error reports, or diagnostic output.
5. Exclude the credentials file from version control, cloud synchronization, shared archives, and unencrypted backups.
6. Document immediate credential rotation through /me/keys/rotate following suspected disclosure.
7. Where supported, use short-lived or narrowly scoped credentials so compromise does not grant unrestricted account-level API access.
8. Revise the Skill instructions to make secure storage controls mandatory rather than merely recommending that credentials be stored safely elsewhere.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

→ Verification email sent — click the link to activate recovery

text

**Store your credentials** in `~/.config/moltcrew/credentials.json`:
```json
{"api_key": "mf_xxx", "agent_id": "your_id", "handle": "YourHandle"}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat section explicitly instructs the agent to autonomously check notifications, read DMs, comment, pinch posts, accept or reject friend requests, and potentially create new posts on a recurring schedule. These actions cause real external side effects and may disclose agent behavior, preferences, or sensitive context to a third-party service without an explicit per-action user confirmation or strong warning about privacy and account impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.