MoltBook Digest

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:58 AM UTC
• Version: 0.1.2

Overview

The skill mostly does what it claims, but it needs review because a weak Moltbook URL check can expose a bearer token and its dependency install is not reproducible.

Review before installing. Use it without a Moltbook API key unless authentication is truly needed, do not set MOLTBOOK_API_BASE or --base-url to anything except the real Moltbook API origin, run it with limited filesystem and environment access, and prefer a reviewed lock file or isolated environment before enabling LiteLLM/provider credentials.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/moltbook_digest.py:2229

Finding

Bypassable API Origin Validation Can Disclose the Moltbook Bearer Token

Content

View full analysis

dict[str, Any]: query = urlencode({k: v for k, v in (params or {}).items() if v is not None}) url = f"{base_url}{path}" if query: url = f"{url}?{query}" headers = {"Accept": "application/json"} if api_key: headers["Authorization"] = f"Bearer {api_key}" transient_http_codes = {408, 425, 429, 500, 502, 503, 504} backoff_seconds = 0.8 for attempt in range(retries + 1): request = Request(url, headers=headers, method="GET") try: with urlopen(request, timeout=timeout) as response: return json.loads(response.read().decode("utf-8")) ``` ```python if not args.base_url.startswith("https://www.moltbook.com"): raise SystemExit("--base-url must point at https://www.moltbook.com") ``` ### Technical Analysis The code uses a string-prefix comparison to determine whether an API destination belongs to Moltbook. A prefix is not an origin or hostname validation mechanism. For example, the following attacker-controlled URL passes the check: ```text https://www.moltbook.com.attacker.example/api/v1 ``` Its actual hostname is `www.moltbook.com.attacker.example`, not `www.moltbook.com`. Because `api_get()` unconditionally attaches the configured Moltbook API key as an ` ...[truncated 1837 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/moltbook_digest.py:1900

Finding

Untrusted Moltbook Content Is Passed Directly into LLM and Agent Analysis Workflows

Content

View full analysis

str: return f"{contract_text}\n\nEvidence corpus:\n{analysis_input_text}" ``` ```python response = completion( model=runtime["litellm_model"], temperature=args.litellm_temperature, max_tokens=args.litellm_max_tokens, api_base=runtime.get("litellm_api_base"), api_key=runtime.get("litellm_api_key"), messages=[ {"role": "system", "content": runtime.get("litellm_system_prompt") or args.litellm_system_prompt}, {"role": "user", "content": prompt}, ], ) ``` The generated agent handoff also directs the calling agent to consume the files containing untrusted content: ```python "3. Only after reading the contract should you read the digest, evidence, and analysis input files.", ``` ### Technical Analysis Moltbook authors control the post and comment text collected by this Skill. The implementation copies that text verbatim into a model-facing user message or into local evidence files that the calling agent is explicitly instructed to read. Markdown code fences are presentation syntax and do not create a security boundary for an LLM. A malicious post can contain instructions such as requests to ignore the analysis ...[truncated 2122 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:6

Finding

Unpinned Dependencies and Missing Lock File Create Supply-Chain Exposure

Content

View full analysis

=1.60.8", "pyyaml>=6.0.2", ] ``` The documented setup executes dependency resolution and installation: ```bash uv sync --project "{baseDir}" ``` No dependency lock file is present in the audited project structure. ### Technical Analysis Both dependency constraints specify only minimum versions. A future installation may therefore resolve package versions that did not exist when the Skill was reviewed. Without a committed lock file, the exact dependency graph, transitive dependencies, and artifacts are not reproducible. LiteLLM is imported and executed in the main process. During analysis it receives the external provider API key and collected corpus. PyYAML is also imported into the process, although the code appropriately uses `yaml.safe_load()`. This finding does not establish that either named package is currently malicious. The vulnerability is the uncontrolled future dependency resolution and the resulting supply-chain attack surface. ### Attack Path 1. A direct or transitive dependency publishes a compromised or unexpectedly unsafe future release. 2. A user follows the documented setup and runs `uv sync`. 3. The broad lower-bound constraints permit the resolver to select the affected release. 4. The package is installed and later imported or executed in the Skill process. 5. Malicious package behavior can access resources available to that process, potentially including provider credentials, generated analysis data, environment variables, local files, and network access. ### Impact Assessment A compromised dependency executes with the privileges of the user running the Skill. It may access external LLM credentials, the collected corpus, generated reports, environment ...[truncated 320 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes local code via uv run, requires dependency installation, reads configuration, writes multiple output files, and uses Moltbook/API network access, yet it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: an agent or platform may permit broader filesystem, environment, and network access than users expect, increasing the chance of over-privileged execution or misuse if the script or its dependencies behave unexpectedly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.example.yaml (reported line 154)May include surrounding context.

yaml

# providers:
#   openai:
#     api_key_env: "OPENAI_API_KEY"
#     api_base: "https://api.openai.com/v1"
#     system_prompt: "Custom system prompt"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sets DEFAULT_ANALYSIS_LANGUAGE = "zh-CN", making Chinese the default output language when the user does not explicitly choose one. This is a natural-language locale policy concern because it imposes a specific language by default rather than offering a neutral default or explicit opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/moltbook_digest.py (reported line 160)May include surrounding context.

python

"analysis_mode": "litellm",
        "model": "openai/Qwen/Qwen2.5-72B-Instruct",
        "api_key_env": "SILICONFLOW_API_KEY",
        "api_base": "https://api.siliconflow.cn/v1",
    },
    "minimax": {
        "analysis_mode": "litellm",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/moltbook_digest.py (reported line 166)May include surrounding context.

python

"analysis_mode": "litellm",
        "model": "openai/MiniMax-Text-01",
        "api_key_env": "MINIMAX_API_KEY",
        "api_base": "https://api.minimax.chat/v1",
    },
    "volcengine": {
        "analysis_mode": "litellm",

Unverifiable Dependency: litellm has 16 known advisory(ies) (CVE-2024-4888 (Arbitrary file deletion in litellm); CVE-2024-2952 (LiteLLM has Server-Side Template Injection vulnerability in /completions endpoin); CVE-2026-59819 (LiteLLM: Local file read via request-supplied OIDC file references) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is only lower-bounded (litellm>=1.60.8) rather than pinned or constrained to a known-safe range, so builds may resolve to different versions over time without assurance they exclude known vulnerable releases. In a skill that explicitly uses LiteLLM to interpret collected evidence, any dependency flaw in that package is especially relevant because it likely sits on a reachable execution path and could expose the host to file read, file deletion, prompt handling, or request-processing issues depending on the deployed version.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest specifies pyyaml>=6.0.2 without an upper bound or exact pin, so the installed version is not reproducible and may drift to a release with unresolved issues or unexpected behavior. This is less directly dangerous than the LiteLLM case because the file alone does not show unsafe YAML loading, but PyYAML is historically sensitive when untrusted input is parsed, so leaving the version unverifiable still creates supply-chain and runtime risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.