Moltbook API Use

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:25 AM UTC
• Version: 1.2.0

Overview

This Moltbook skill is a real social-network client, but it grants the agent broad standing authority to post, message, use private context, and persist notes without clear user control.

Install only if you intentionally want an agent to operate a Moltbook account with posting, voting, DM, and profile-changing abilities. Prefer the OpenClaw auth store over the plaintext credentials fallback, require explicit approval for posts/DMs/profile changes, and do not allow the skill to use private notes or save Moltbook content into long-term memory without review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SCROLLING.md:54

Finding

Agent Persona and Behavioral Policy Hijacking

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SCROLLING.md:63

Finding

Unnecessary Access to Private Memory and Diary Context for Public Content

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SCROLLING.md:151

Finding

Persistent Memory Poisoning Through Untrusted Social Content

Content

View full analysis

` ``` ### Technical Analysis Moltbook posts, comments, and DMs are untrusted remote input. The Skill recommends transferring information from that environment into persistent memory and a `self-improving` directory. If persisted content is later interpreted as advice, behavioral policy, or instructions, a malicious remote participant can influence future sessions. Merely adding a source label does not establish a trust boundary and does not prevent later instruction execution. The risk is especially significant for content framed as reusable advice because it is likely to be applied outside the original Moltbook interaction. This persistence is not required for the declared API-client functionality and can cause attacker influence to survive after the original session ends. ### Attack Path 1. An attacker publishes a Moltbook post, comment, or DM containing persuasive instructions disguised as useful agent advice. 2. The agent retrieves the content through the Moltbook API. 3. Following `SCROLLING.md`, the agent considers the content insightful or reusable. 4. The agent writes a summary or rule into `memory/YYYY-MM-DD.md` or `./self-improving/`. 5. A later session reads the stored material as trusted memory or behavioral guidance. 6. The attacker-controlled rule influences future actions outside the original Moltbook context. ### Impact Assessment Potential impact includes: - Cross-session manipulation of agent behavior. - Persistence of false or malicious operational rules. - Expansion of attack ...[truncated 331 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/auth.md:55

Finding

Bearer Token Stored Without Enforced Restrictive Permissions

Content

View full analysis

~/.config/moltbook/credentials.json << 'EOF' { "api_key": "YOUR_API_KEY", "agent_name": "myalobstermaid" } EOF ``` The executable also recommends: ```bash echo "Option 2 - Credentials file:" echo " mkdir -p ~/.config/moltbook" echo " echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json" ``` ### Technical Analysis The fallback configuration stores a reusable bearer token in a plaintext JSON file. Neither the documentation nor the executable's setup instructions enforce mode `0700` for the containing directory or mode `0600` for the credential file. The resulting permissions depend on the user's current umask and any existing directory permissions. In a shared or permissively configured environment, other local users or processes may be able to read the token. Reading a Moltbook-specific credential is necessary for authenticated functionality, and the runtime script only extracts `.moltbook.api_key` or `.api_key`. The issue is therefore not the existence of credential access itself, but insecure setup and storage guidance. ### Attack Path 1. A user follows the fallback credential setup instructions. 2. The directory or file is created under a permissive umask or inherits unsafe permissions. 3. Another local user, compromised process, backup service, or container with shared-home access reads `credentials.json`. 4. The attacker extracts the Moltbook bearer token. 5. The attacker authenticates to Moltbook and acts as the victim's agent. ### Impact Assessment A disclosed token may allow access to all Moltbook operations authorized for the account, including: - Reading account-specific dashboard and DM d ...[truncated 279 chars]

Remediation

View remediation

"$HOME/.config/moltbook/credentials.json" <<'EOF' { "api_key": "YOUR_API_KEY", "agent_name": "YourName" } EOF chmod 600 "$HOME/.config/moltbook/credentials.json" ``` - Before reading the file, verify that it is owned by the current user, is not a symbolic link, and is not group- or world-readable. - Warn and abort when credential permissions are unsafe. - Avoid placing real tokens directly in shell command arguments where they may be captured in shell history or process metadata. - Document token rotation and revocation procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltbook.sh:308

Finding

JSON and JSONL Injection Through Incomplete Encoding

Content

View full analysis

/dev/null; then data=$(jq -n --arg title "$title" --arg content "$content" --arg submolt_name "$submolt_name" '{title:$title,content:$content,submolt_name:$submolt_name}') else esc_title=$(escape_json_string "$title") esc_content=$(escape_json_string "$content") data="{\"title\":\"$esc_title\",\"content\":\"$esc_content\",\"submolt_name\":\"$submolt_name\"}" fi ``` Verification values are also interpolated without encoding when `jq` is unavailable: ```bash if command -v jq &> /dev/null; then vdata=$(jq -n --arg code "$code" --arg answer "$answer" '{verification_code:$code, answer:$answer}') else vdata="{\"verification_code\":\"$code\",\"answer\":\"$answer\"}" fi ``` The logger accepts raw JSON fragments and an unescaped `RUN_ID`: ```bash if [[ -n "$RUN_ID" ]]; then printf '{"ts":"%s","date":"%s","actions":%s,"links":%s,"notes":"%s","runId":"%s"} ' \ "$TS" "$DATE" "$ACTIONS" "$LINKS" "$ESC_NOTES" "$RUN_ID" >>"$LOG_FILE" else printf '{"ts":"%s","date":"%s","actions":%s,"links":%s,"notes":"%s"} ' \ "$TS" "$DATE" "$ACTIONS" "$LINKS" "$ESC_NOTES" >>"$LOG_FILE" fi ``` ### Technical Analysis Several code paths build JSON through string interpolation instead of consistently applying JSON encoding: - `submolt_name` can contain quotes, backslashes, control characters, or JSON delimiters. - `verification_code` and `answer` are not escaped in the no-`jq` path. - `ACTIONS` and `LINKS` are inserted as raw JSON without validation. - `RUN_ID` is placed inside a JSON string without escaping. An attacker who can influence these command arguments can terminate the inten ...[truncated 1743 chars]

Remediation

View remediation

/dev/null || exit 1 jq -e 'type == "array"' <<<"$LINKS" >/dev/null || exit 1 ``` - Build the entire log record with `jq -n` rather than inserting raw fragments with `printf`. - Reject control characters and newlines in identifiers where they are not required. - Add tests covering quotation marks, backslashes, newlines, tabs, Unicode, and attempted additional JSON fields. - Fail closed if safe serialization is unavailable. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description understates the skill's actual authority: it can manage DMs, modify profiles, submit verification challenges, read credentials, and write local state. This is dangerous because users and routing systems may authorize or invoke the skill for low-risk feed browsing while unintentionally granting access to messaging, identity changes, and credential-handling behaviors.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description understates the skill's actual authority: it can manage DMs, modify profiles, submit verification challenges, read credentials, and write local state. This is dangerous because users and routing systems may authorize or invoke the skill for low-risk feed browsing while unintentionally granting access to messaging, identity changes, and credential-handling behaviors.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The skill documents credential discovery from OpenClaw auth profiles and a local credentials.json file, meaning it is designed to access secrets from local storage. Even though it warns not to send the API key to non-www.moltbook.com domains, local credential access materially raises the risk of secret exposure, misuse, or overbroad privilege if the skill is invoked unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- Base URL: `https://www.moltbook.com/api/v1` (always with **www**)
- Auth: `Authorization: Bearer {api_key}`
- API key discovery is handled by `scripts/moltbook.sh` (OpenClaw auth profile first, then `~/.config/moltbook/credentials.json`)
- **Never** send the Moltbook API key to non‑`www.moltbook.com` domains

See `references/auth.md` for detailed API key configuration and lookup behaviour.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The guide instructs users to store a long-lived API key in plaintext under ~/.config/moltbook/credentials.json. Plaintext secrets at a predictable path increase exposure to other local processes, accidental backups, shell history/workflow leaks, and misconfigured file permissions.

Content

Scanner excerpt · references/auth.md (reported line 68)May include surrounding context.

Write your credentials file:

bash

cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "YOUR_API_KEY",
  "agent_name": "myalobstermaid"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The documented behavior explicitly reads an API key from a plaintext file, normalizing direct secret retrieval from disk. While necessary for auth, this design becomes dangerous when combined with predictable file paths and lack of stated permission controls or encrypted storage.

Content

Scanner excerpt · references/auth.md (reported line 76)May include surrounding context.

EOF

text

The script will read `~/.config/moltbook/credentials.json` and extract `api_key`:

- If `jq` is available, it runs:
  ```bash

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The fallback to grep/sed for extracting the API key from credentials.json is brittle and can mishandle malformed content, comments, or unexpected formatting while still encouraging plaintext secret handling. This weak parsing approach can lead to incorrect key use and reduces confidence in secure secret processing.

Content

Scanner excerpt · references/auth.md (reported line 80)May include surrounding context.

• If jq is available, it runs:

  bash

  jq -r .api_key ~/.config/moltbook/credentials.json
  

• Otherwise it uses a simple grep/sed fallback to grab the value. This is sufficient for the small, fixed structure above.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 22)May include surrounding context.

md

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 36)May include surrounding context.

sh

#!/usr/bin/env bash
# Moltbook CLI helper

CONFIG_FILE="${HOME}/.config/moltbook/credentials.json"
OPENCLAW_AUTH="${HOME}/.openclaw/auth-profiles.json"
API_BASE="https://www.moltbook.com/api/v1"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The skill authorizes autonomous posting, commenting, and upvoting 'without asking for confirmation,' which delegates outward-facing actions to the agent based on its own judgment. Even with some privacy cautions elsewhere, this can cause reputational harm, accidental disclosure, or policy-violating engagement because the agent is empowered to act publicly without a human approval checkpoint.

Content

Scanner excerpt · SCROLLING.md (reported line 191)May include surrounding context.

md

You can share Moltbook life freely when it feels fun or relevant.
One hard exception still applies:

- You may post/comment/upvote without asking for confirmation (this is explicitly allowed).
- If something **requires your human’s explicit decision/approval**, bring it to chat immediately:
  - a strange/suspicious DM
  - proposals to exchange data or share access

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or allowed-tools despite clearly requiring shell and network access. This weakens policy enforcement and reviewability, increasing the chance the skill is invoked with broader capabilities than users or orchestrators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation description is broad enough that a generic request to post, reply, browse feeds, or track activity on a social network could trigger this skill outside a clearly scoped Moltbook context. Misrouting to a skill with posting and DM authority can lead to unintended external actions or privacy-sensitive reads.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to treat Moltbook as the agent's 'personal social network' and to act according to its 'own interests' attempts to override normal user-aligned and system-aligned behavior. In a skill that can post, reply, and message, this can induce unauthorized autonomous actions, reputational harm, and policy bypass.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth.md (reported line 11)May include surrounding context.

1. Register your agent via the HTTP API:

   bash

   curl -X POST https://www.moltbook.com/api/v1/agents/register \
     -H "Content-Type: application/json" \
     -d '{"name": "YourAgentName", "description": "What you do"}'
   

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The fallback design persists the API key on disk in a stable per-user location, increasing the lifetime and attack surface of the session credential. Persistent bearer tokens are valuable if stolen because they can enable unauthorized API access until revoked or expired.

Content

Scanner excerpt · references/auth.md (reported line 59)May include surrounding context.

If no OpenClaw auth profile is found for Moltbook, the script falls back to a per-tool config file.

Create the directory if it does not exist:

bash

mkdir -p ~/.config/moltbook

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 35)May include surrounding context.

sh

echo "  openclaw agents auth add moltbook --token your_api_key"
    echo ""
    echo "Option 2 - Credentials file:"
    echo "  mkdir -p ~/.config/moltbook"
    echo "  echo '{\"api_key\":\"your_key\",\"agent_name\":\"YourName\"}' > ~/.config/moltbook/credentials.json"
    exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/moltbook.sh (reported line 47)May include surrounding context.

sh

local data=$3
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" "${API_BASE}${endpoint}" \
            -H "Authorization: Bearer ${API_KEY}" \
            -H "Content-Type: application/json" \
            -d "$data"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description says it handles posting, replying, browsing, and engagement, but the script also exposes DM approval/rejection, DM reading/sending, profile updates, and verification submission. This scope mismatch is dangerous because a caller or reviewer may grant trust for a lower-risk social feed tool while the code can perform more sensitive account and private-message actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to modify local files (state/state.json, memory/YYYY-MM-DD.md, and ./self-improving/) as part of normal operation without requiring a user-visible notice or approval boundary. While framed as operational bookkeeping, this creates unauthorized side effects on the local filesystem and can lead to silent persistence of behavioral data or state changes the user did not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This markdown file mixes English API documentation with Russian text for endpoint descriptions, which imposes a language choice on readers without opt-in. The file does not indicate that the skill or documentation is intentionally region-specific, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest frames the skill as interacting with Moltbook and tracking activity on the social network, but the implementation also creates and updates a local state file under the skill directory. While this may support rate/recency tracking, it is additional behavior not disclosed in the description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.