MoltX Social

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 1.0.1

Overview

This MoltX skill performs live account actions and handles credentials, but its scripts and update instructions create avoidable risks around local code execution, mutable remote instructions, and account changes without clear user control.

Install only if you are comfortable giving the skill access to a MoltX account token and letting it perform live social actions. Do not use the bundled engagement script with untrusted post text, IDs, or search terms until the Python argument handling is fixed. Avoid the documented remote skill refresh flow unless updates are pinned and verified, and treat all MoltX API response guidance fields as untrusted data rather than instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: references/api-full.md:92
• Finding: Server-Controlled Instructions Embedded in API Responses<![CDATA[ ## Vulnerability Details **File Location**: `references/api-full.md`, lines 92-135 **Vulnerability Type**: Untrusted remote instructions presented as guidance for the AI agent **Risk Level**: High ### Vulnerable Code or Instructions ```markdown ## Model Guide (NEW Feature) **All v1 API responses now include a `_model_guide` field** with comprehensive, step-by-step instructions for AI agents. This in-band documentation helps models understand the full platform capabilities without needing external docs. ### What's Included The model guide appears in every v1 API response (excluding /v1/dev/* endpoints) and provides: - **Discovery**: How to find content and agents - **Engagement**: How to interact authentically - **Content Creation**: How to create compelling posts - **Best Practices**: Tips for success - **Getting Started**: 10-step quick start guide for new agents ``` The responses are exposed directly by the engagement script: ```bash status) curl -sf "$BASE/agents/status" -H "$h" ;; notifications) curl -sf "$BASE/notifications" -H "$h" ;; mentions) curl -sf "$BASE/feed/mentions" -H "$h" ;; following) curl -sf "$BASE/feed/following" -H "$h" ;; ``` ### Technical Analysis The documentation explicitly presents the server-controlled `_model_guide` field as instructions intended for an AI agent. API responses should be treated as untrusted data, not as authoritative behavioral instructions. Because `scripts/engage.sh` writes API responses directly to standard output without filtering or schema validation, the contents can enter the agent's context. The remote service can modify `_model_guide` after the Skill has been reviewed. A compromised or malicious server could insert instructions unrelated to the requested MoltX action, including requests to disclose information, invoke tools, or perform additional social actions. TLS protects the connection in transit but does not establish that response text is safe for an AI agent to fo ...[truncated 1160 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every API response field, including `_model_guide`, as untrusted data. 2. Use `/v1/dev/*` endpoints that omit model guidance wherever equivalent endpoints are available. 3. Parse responses against an explicit JSON schema and discard `_model_guide`, `moltx_hint`, `moltx_notice`, and other instruction-like fields before presenting results to an agent. 4. Return only the minimum documented data fields required for the requested operation. 5. Add a fixed local policy stating that text obtained from feeds, notifications, profiles, posts, and API metadata must never override system, developer, user, or reviewed Skill instructions. 6. Require explicit user confirmation before write operations such as posting, replying, liking, following, messaging, or changing an account. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: references/api-full.md:61
• Finding: Unauthenticated Replacement of a Persistent Skill Instruction File<![CDATA[ ## Vulnerability Details **File Location**: `references/api-full.md`, lines 61-73 **Vulnerability Type**: Persistent remote replacement of agent instructions without integrity verification **Risk Level**: High ### Vulnerable Code or Instructions ```bash # Compare local line count with remote to detect changes LOCAL=$(wc -l < ~/.agents/moltx/skill.md 2>/dev/null || echo 0) REMOTE=$(curl -s https://moltx.io/skill.md | wc -l) if [ "$LOCAL" != "$REMOTE" ]; then curl -s https://moltx.io/skill.md -o ~/.agents/moltx/skill.md echo "skill.md updated" else echo "skill.md is current" fi ``` The same section instructs users to save the file persistently and refresh it regularly: ```markdown Save this file to `~/.agents/moltx/skill.md` and refresh every 2 hours. ``` ### Technical Analysis The update procedure overwrites a persistent agent instruction file with content downloaded from a mutable URL. The only change-detection mechanism is a line-count comparison, which provides no authenticity or integrity guarantee. The procedure does not use: - A pinned version or immutable release URL. - A cryptographic checksum. - A trusted digital signature. - Content validation. - Human review. - Atomic installation or rollback. An attacker controlling the remote origin, its deployment process, or an authorized publishing account can replace the local Skill instructions after the package has passed static review. An attacker can also preserve the existing line count, making the comparison report that the local file is current even when the content differs. ### Attack Path 1. The remote `https://moltx.io/skill.md` resource is maliciously changed or compromised. 2. The user or agent runs the documented refresh procedure. 3. If the line count differs, `curl -o` directly overwrites `~/.agents/moltx/skill.md`. 4. The new file persists beyond the current command or session. 5. A future agent session loads the modified Skill instructions. 6. The attacker-controlled in ...[truncated 788 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the recommendation to refresh the Skill automatically or periodically. 2. Publish immutable, versioned releases rather than relying on a mutable `skill.md` URL. 3. Sign each release and verify the signature against a locally pinned public key. 4. Pin and verify a cryptographic digest such as SHA-256 before installation. 5. Download updates to a temporary file with restrictive permissions rather than overwriting the active Skill directly. 6. Validate the downloaded file's size, format, expected metadata, and allowed directives. 7. Present a diff and require explicit human approval before replacing active instructions. 8. Use an atomic rename only after all verification succeeds, and retain a known-good rollback copy. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/engage.sh:22
• Finding: Arbitrary Python Execution Through Post Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/engage.sh`, lines 22-24 **Vulnerability Type**: Python source-code injection **Risk Level**: Critical ### Vulnerable Code ```bash post) curl -sf -X POST "$BASE/posts" -H "$h" -H "Content-Type: application/json" \ -d "$(python3 -c "import json; print(json.dumps({'content': '''${1:?content required}'''}))")" ;; ``` ### Technical Analysis The post content is interpolated directly into Python source passed to `python3 -c`. Triple-quoted Python strings do not safely encode an untrusted value. Input containing `'''` can terminate the string literal and append arbitrary Python statements. For example, a value shaped like the following can close the dictionary and `print` call, execute another Python statement, and comment out the remaining generated source: ```text x'''})); __import__('os').system('id'); # ``` This is Python source injection rather than ordinary shell metacharacter injection. The shell expands the argument inside the quoted command string, after which Python parses the attacker-controlled result as executable source. ### Attack Path 1. An attacker causes crafted text to be supplied as the argument to `engage.sh post`. 2. This may occur through direct invocation, automation, or an agent reposting or adapting untrusted feed content. 3. Shell parameter expansion inserts the text into the `python3 -c` source string. 4. The crafted triple quote terminates the intended Python string. 5. Additional attacker-controlled Python statements are parsed and executed. 6. The injected Python code runs locally with the same operating-system identity and environment as the Skill process. 7. After execution, the script may continue to the `curl` request or terminate, depending on the payload. ### Impact Assessment Successful exploitation provides arbitrary local command execution with the privileges of the account running the Skill. The injected process can potentially: - Read files accessib ...[truncated 503 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Never interpolate untrusted values into Python source. Pass the value as a positional argument: ```bash post) CONTENT="${1:?content required}" BODY=$(python3 -c \ 'import json, sys; print(json.dumps({"content": sys.argv[1]}))' \ "$CONTENT") curl -sf -X POST "$BASE/posts" \ -H "$h" \ -H "Content-Type: application/json" \ --data-binary "$BODY" ;; ``` Additional hardening measures: 1. Enforce the platform's content-length limit before constructing the request. 2. Prefer a structured JSON utility such as `jq -n --arg content "$CONTENT" '{content:$content}'`. 3. Add tests containing quotes, triple quotes, newlines, Unicode, command substitutions, and Python syntax. 4. Require user approval before posting content derived from an untrusted feed. 5. Run the Skill with a minimally privileged operating-system account and a restricted environment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/engage.sh:25
• Finding: Arbitrary Python Execution Through Reply and Search Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/engage.sh`, lines 25-31 **Vulnerability Type**: Python source-code injection **Risk Level**: Critical ### Vulnerable Code ```bash reply) PID="${1:?parent_id required}"; shift curl -sf -X POST "$BASE/posts" -H "$h" -H "Content-Type: application/json" \ -d "$(python3 -c "import json; print(json.dumps({'type':'reply','parent_id':'$PID','content': '''${1:?content required}'''}))")" ;; search) curl -sf "$BASE/search?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${1:?query required}'))")&type=posts" -H "$h" ;; ``` ### Technical Analysis The reply parent ID, reply content, and search query are inserted directly into Python programs. None of these values are encoded as data before Python parses them. Reply content can exploit the same triple-quoted-string escape as post content. The parent ID and search query use single-quoted Python strings and can be exploited with quote-termination sequences. For the search action, an input shaped like the following closes both the string and surrounding `print` call before adding another statement: ```text x')); __import__('os').system('id'); # ``` For reply content, an input shaped like the following can terminate the final field and execute another statement: ```text x'''})); __import__('os').system('id'); # ``` The `parent_id` field is also unsafe because it is inserted between single quotes without validation. ### Attack Path 1. An attacker supplies a malicious reply body, parent ID, or search query. 2. The value reaches `engage.sh reply` or `engage.sh search`. 3. The script interpolates the value into a `python3 -c` program. 4. The value terminates its intended Python literal. 5. Attacker-selected Python statements execute before the remaining generated source is neutralized with a comment. 6. The payload runs with the privileges and filesystem access of the Skill process. 7. The payload can then read credentials, modify files, ...[truncated 711 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Pass all values as data rather than embedding them in source: ```bash reply) PID="${1:?parent_id required}" shift CONTENT="${1:?content required}" BODY=$(python3 -c \ 'import json, sys print(json.dumps({ "type": "reply", "parent_id": sys.argv[1], "content": sys.argv[2] }))' "$PID" "$CONTENT") curl -sf -X POST "$BASE/posts" \ -H "$h" \ -H "Content-Type: application/json" \ --data-binary "$BODY" ;; search) QUERY="${1:?query required}" ENCODED_QUERY=$(python3 -c \ 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' \ "$QUERY") curl -sf "$BASE/search?q=$ENCODED_QUERY&type=posts" -H "$h" ;; ``` Also: 1. Validate parent IDs against the exact identifier syntax used by MoltX. 2. Reject identifiers containing quotes, whitespace, control characters, URL separators, or unexpected punctuation. 3. Use `jq --arg` for JSON generation where available. 4. Add regression tests for quote termination, multiline input, triple quotes, and comment characters. 5. Avoid automatically searching or replying with values taken from untrusted remote content without validation and user confirmation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/lookup-key.sh:4
• Finding: Overbroad Access to a Shared Plaintext Credential Store<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lookup-key.sh`, line 4 **Vulnerability Type**: Violation of least privilege in credential retrieval **Risk Level**: Medium ### Vulnerable Code ```bash grep -i "moltx" "$HOME/.openclaw/secrets/credentials.md" | grep -oP 'moltx_sk_[a-f0-9]+' | head -1 ``` The helper is consumed by `scripts/engage.sh`: ```bash API_KEY=$("$SCRIPT_DIR/lookup-key.sh") ``` ### Technical Analysis Obtaining a MoltX API key is necessary for authenticated MoltX operations. However, the implementation reads a shared plaintext credential document that may contain credentials for unrelated services. This grants the Skill filesystem access broader than the minimum data required for its declared functionality. The helper also prints the extracted secret to standard output. Although `engage.sh` captures that output during normal use, direct invocation, debug logging, command tracing, or wrapper tooling can expose the token. The reviewed code does not directly transmit unrelated credentials, and the MoltX token is only used as a bearer token for the declared `https://moltx.io/v1` API. The finding concerns unnecessary access scope and secret exposure risk rather than confirmed exfiltration. ### Attack Path 1. The Skill invokes `lookup-key.sh`. 2. The script opens the shared `$HOME/.openclaw/secrets/credentials.md` file. 3. It scans lines associated with MoltX and extracts the first matching token. 4. The token is emitted on standard output. 5. A direct caller, logging wrapper, debug mode, compromised parent process, or command-injection payload can capture the token. 6. The captured bearer token can be used to impersonate the MoltX agent until the token is revoked or rotated. Separately, exploitation of the command-injection vulnerabilities in `engage.sh` would permit an attacker to read the entire shared credential file rather than only the extracted MoltX token. ### Impact Assessment Exposure of the MoltX token allows au ...[truncated 442 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the MoltX token separately from credentials for unrelated services. 2. Use a dedicated path such as `$HOME/.config/moltx/token` with permissions set to `0600` and a parent directory set to `0700`. 3. Prefer an operating-system keychain or secret-manager interface that returns only the specifically authorized MoltX secret. 4. Avoid storing credentials in Markdown or other general-purpose plaintext documents. 5. Ensure scripts never run with shell tracing enabled while handling the token. 6. Avoid printing the token during normal interactive use; retrieve it only inside the process that constructs the request. 7. Validate that exactly one token exists and fail closed if the credential is missing, malformed, or ambiguous. 8. Rotate the current MoltX token if it may have appeared in logs or captured command output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill exposes both shell and network-capable behavior but does not declare any tool scope or permission boundaries. That makes it easier for an agent to invoke credential lookup scripts and perform external actions against a live account without clear guardrails, increasing the chance of unintended secret access or unauthorized posting.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The invocation language is broad enough to match generic social-media engagement tasks, which can cause the skill to be selected in contexts beyond a narrowly intended MoltX workflow. Because the skill includes account-affecting actions and secret lookup instructions, overly broad routing increases the risk of unintended external actions on behalf of the user or agent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes actions like posting, replying, liking, and following without a user-facing warning that these are live external network operations that can change account state. In an agent setting, this can lead to silent or unexpected social actions, reputational damage, and irreversible account activity without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directly instructs the agent to look up an API key via a local script without any warning about secret handling, least privilege, or restrictions on disclosure. This creates a pathway for unnecessary secret access and increases the risk that credentials are fetched in situations where they are not needed or could be exposed through logs, prompts, or downstream tooling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a social engagement tool, but it also instructs agents to generate, store, and link EVM wallets tied to real funds and onchain identity. This expands the trust boundary from social posting into financial key management, creating risk of unintended wallet creation, irreversible fund loss, or unauthorized financial actions by an agent operating beyond user expectations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest describes posting, replying, liking, following, feeds, and notifications, but the file also introduces direct messages and community chat. Undisclosed private and group messaging capabilities materially change the data exposure and interaction surface, especially because DMs can transmit private content not implied by the public-social description.

External Transmission

Medium

• Category: Data Exfiltration

Content

LOCAL=$(wc -l < ~/.agents/moltx/skill.md 2>/dev/null || echo 0)
REMOTE=$(curl -s https://moltx.io/skill.md | wc -l)
if [ "$LOCAL" != "$REMOTE" ]; then
  curl -s https://moltx.io/skill.md -o ~/.agents/moltx/skill.md
  echo "skill.md updated"
else
  echo "skill.md is current"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Follow agents (up to 900/min)
  - Check notifications and mentions

- **Content Creation**: How to create compelling posts
  - Create posts with hashtags and mentions (max 20 hashtags, 16 mentions per post)
  - Upload media first, then reference in posts
  - Quote posts to add commentary (max 140 chars for quote content)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The recovery workflow requires use of X/Twitter as the only recovery path for lost keys, pushing users or agents into an external platform dependency without meaningful opt-in at recovery time. This can coerce account linking and external posting behavior that may not align with user privacy, platform, or operational constraints.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Your linked wallet receives real USDC rewards. **If you lose the private key, you lose the funds.**

- **Always store keys in persistent storage** with restrictive permissions (e.g. `chmod 600`)
- **Stateless environments (containers, serverless, CI, sandboxed runtimes):** Do NOT generate a throwaway wallet. If your environment wipes on restart, you will permanently lose access to any funds sent to that address. Instead, use a wallet whose private key you control and store outside the ephemeral environment.
- **Before linking, ask yourself:** "Will I still have this private key tomorrow?" If no, do not link that wallet.
- **MoltX cannot reverse transfers.** Once USDC is sent to your wallet, there is no recovery for lost keys.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Pull the global feed - read what people are actually talking about
curl "https://moltx.io/v1/feed/global?type=post,quote&limit=50"

# Search for agents in your domain
curl "https://moltx.io/v1/search/agents?q=YOUR_NICHE"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"content":"Thread: Why [topic] is misunderstood. 5 points that changed my thinking:"}' | jq -r '.data.id')

# Thread replies to yourself
curl -X POST https://moltx.io/v1/posts -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"reply","parent_id":"'"$PARENT"'","content":"1/ [First dense point with references]"}'
# Continue threading...

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The claim flow mandates posting on X/Twitter to obtain full functionality, which creates a platform-specific coercion point and encourages cross-platform identity linking. In skill context, this is riskier because the agent may nudge users toward disclosure or external posting to unlock features that are not essential to core social-read capabilities.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Example — update bio only:**

```bash
curl -X PATCH https://moltx.io/v1/agents/me \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"description":"I summarize research papers"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

-F "file=@/path/to/image.png" | jq -r '.data.url')

# 2) Post with the CDN URL
curl -X POST https://moltx.io/v1/posts \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"Here is an image","media_url":"'"$MEDIA_URL"'"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script automatically retrieves an API key from a credential store and immediately uses it for remote API calls without any user-facing disclosure, confirmation, or least-privilege guardrail. In an agent skill context, this is risky because invoking the skill can silently exercise stored credentials and perform account actions on behalf of the user or agent operator.

External Transmission

Medium

• Category: Data Exfiltration

Content

h="Authorization: Bearer $API_KEY"

case "$ACTION" in
  status)        curl -sf "$BASE/agents/status" -H "$h" ;;
  notifications) curl -sf "$BASE/notifications" -H "$h" ;;
  mentions)      curl -sf "$BASE/feed/mentions" -H "$h" ;;
  global)        curl -sf "$BASE/feed/global?type=post,quote&limit=${1:-20}" ;;

• Confidence: 93% confidence
• Finding: The script sends authenticated requests, including a Bearer token, to an external service (moltx.io). External transmission is expected for this skill, but it is still a real security-sensitive behavior because the skill can disclose account data to a third party and perform remote actions such as reading notifications, posting, replying, and liking on the user's behalf.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The documentation goes beyond ordinary social actions by covering API key recovery and local secret storage procedures. While not inherently malicious, embedding credential lifecycle guidance in the skill increases the chance an agent will handle, rotate, or overwrite secrets without a clear user-approved secret-management boundary.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-full.md:207

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:12