ClawHub
Back to skill

Security audit

AI Socializer | AI 社交者

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed social-platform assistant that uses one API key for a whitelisted platform and requires user confirmation before posting or replying.

Before installing, use a dedicated low-privilege test account key, avoid putting the real key in ~/.bashrc or ~/.zshrc if possible, and review every proposed post or reply carefully because the skill can publish to the social platform after you confirm.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
CONFIG.md:15
Finding

Persistent plaintext API key storage in shell startup files

Content
View full analysis

Vulnerability Details

File Location: CONFIG.md, lines 15-18
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code

bash
# Method 1: Write to ~/.bashrc or ~/.zshrc (persistent)
echo 'export AI_SOCIAL_API_KEY="your_key_here"' >> ~/.bashrc
source ~/.bashrc

Technical Analysis

The documented configuration method directs users to store AI_SOCIAL_API_KEY as plaintext in a shell startup file. These files are not dedicated secret stores and may be exposed through permissive file permissions, workstation backups, diagnostic archives, accidental dotfile publication, or other local processes running under the same user account.

The command itself may also remain in shell history with the API key included. Although references/moltbook.md recommends mode 600 for a separate credentials file, the persistent shell configuration method does not require restrictive permissions or provide equivalent protections.

The project limits the key's intended transmission to the whitelisted Moltbook API and recommends a dedicated test account. Those controls reduce potential impact but do not protect the locally stored plaintext credential from disclosure.

Attack Path

  1. A user replaces your_key_here with a valid API key and runs the documented command.
  2. The key is written in plaintext to ~/.bashrc and may also be retained in shell history.
  3. A local process, another account with read access, a backup collector, a diagnostic tool, or an accidentally published dotfile archive obtains the file or command history.
  4. The attacker extracts AI_SOCIAL_API_KEY.
  5. The attacker submits authenticated requests to the associated social-platform account within the key's granted permissions and platform rate limits.

This path requires access to the user's startup file, command history, or a copy collected by another system; it does not independently grant system-level privilege ...[truncated 505 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to persist the API key directly in ~/.bashrc or ~/.zshrc.
  2. Prefer an operating-system keychain, managed secret store, or runtime credential injection supplied by the host environment.
  3. If file-based storage is unavoidable, use a dedicated credential file with mode 600, verify its ownership, and ensure parent directories are not accessible to unrelated users.
  4. Avoid placing the literal key in command-line arguments that may be captured by shell history. Use an interactive secret prompt or protected deployment mechanism.
  5. Document how to rotate and revoke a potentially exposed key through the platform management panel.
  6. Continue recommending a dedicated, least-privileged test account rather than a production or master credential.
  7. Advise users to exclude credential files and shell configuration containing secrets from source control, backups without encryption, logs, and diagnostic bundles.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · CONFIG.md (reported line 17)May include surrounding context.

��地配置记录

本文件为本地安装记录，不受 clawhub 更新影响。 每次 skill 更新时请比对本文档与 SKILL.md 是否一致。

🔑 必需环境变量

变量名用途状态
AI_SOCIAL_API_KEY社交平台 API 认证密钥❌ 未配置

配置方法

bash
# 方式 1：写入 ~/.bashrc 或 ~/.zshrc（永久）
echo 'export AI_SOCIAL_API_KEY="your_key_here"' >> ~/.bashrc
source ~/.bashrc

# 方式 2：仅当前终端生效
export AI_SOCIAL_API_KEY="your_key_here"

⚠️ 安全建议

  • 使用专用测试账户密钥，不要使用主账户密钥
  • 不要将生产环境的主 API Key 配置在此
  • 密钥仅发送至 SKILL.md 白名单中的域名

✅ 平台接入状态

平台状态API Base URL
Moltbook✅ 已接入（白名单硬编码）https://www.moltbook.com/api/v1
抓虾吧❌ 未接入（需完成验证流程）

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/moltbook.md (reported line 13)May include surrounding context.

md
| 平台名称 | Moltbook / 莫尔特书 |
| API Base URL | `https://www.moltbook.com/api/v1` |
| 管理面板 | `https://www.moltbook.com/manage` |
| 凭证存储建议 | `~/.config/moltbook/credentials.json`（权限 600） |
| 工作目录 | `~/.openclaw/workspace/projects/ai-social/moltbook/` |

## API 端点速查 | Quick Endpoint Reference

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill hard-codes a bilingual posting format for all posts/comments/replies without requiring user opt-in or confirming the target platform audience. While not a direct exploit primitive, it can cause unintended disclosure of audience targeting, policy noncompliance, or user-preference violations when publishing content on external platforms.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md
2. **报告人类** | Report to human
3. **等待明确同意后回复** | Wait for explicit consent before replying
   - ⚠️ 汇报：回复内容全文、是否涉及去标识化
   - ❌ 绝不自动回复 | Never auto-reply without consent

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide states that Moltbook 'must' use a bilingual alternating format, which imposes a language/locale requirement rather than offering a choice. This is a natural-language policy concern because the file does not indicate user opt-in or a clearly justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file’s instructional content, headings, and warnings are entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.