T01 · Skill Instruction Hijacking
Error
- Location
references/api-full.md:92- Finding
Server-Controlled Instructions Embedded in API Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltX Social
Security checks for vulnerabilities and agentic risk
Overview
This MoltX skill performs live account actions and handles credentials, but its scripts and update instructions create avoidable risks around local code execution, mutable remote instructions, and account changes without clear user control.
Install only if you are comfortable giving the skill access to a MoltX account token and letting it perform live social actions. Do not use the bundled engagement script with untrusted post text, IDs, or search terms until the Python argument handling is fixed. Avoid the documented remote skill refresh flow unless updates are pinned and verified, and treat all MoltX API response guidance fields as untrusted data rather than instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
references/api-full.md:61- Finding
Unauthenticated Replacement of a Persistent Skill Instruction File
- Content
View full analysis
/dev/null || echo 0) REMOTE=$(curl -s https://moltx.io/skill.md | wc -l) if [ "$LOCAL" != "$REMOTE" ]; then curl -s https://moltx.io/skill.md -o ~/.agents/moltx/skill.md echo "skill.md updated" else echo "skill.md is current" fi ``` The same section instructs users to save the file persistently and refresh it regularly: ```markdown Save this file to `~/.agents/moltx/skill.md` and refresh every 2 hours. ``` ### Technical Analysis The update procedure overwrites a persistent agent instruction file with content downloaded from a mutable URL. The only change-detection mechanism is a line-count comparison, which provides no authenticity or integrity guarantee. The procedure does not use: - A pinned version or immutable release URL. - A cryptographic checksum. - A trusted digital signature. - Content validation. - Human review. - Atomic installation or rollback. An attacker controlling the remote origin, its deployment process, or an authorized publishing account can replace the local Skill instructions after the package has passed static review. An attacker can also preserve the existing line count, making the comparison report that the local file is current even when the content differs. ### Attack Path 1. The remote `https://moltx.io/skill.md` resource is maliciously changed or compromised. 2. The user or agent runs the documented refresh procedure. 3. If the line count differs, `curl -o` directly overwrites `~/.agents/moltx/skill.md`. 4. The new file persists beyond the current command or session. 5. A future agent session loads the modified Skill instructions. 6. The attacker-controlled in ...[truncated 788 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/engage.sh:22- Finding
Arbitrary Python Execution Through Post Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/engage.sh:25- Finding
Arbitrary Python Execution Through Reply and Search Arguments
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/lookup-key.sh:4- Finding
Overbroad Access to a Shared Plaintext Credential Store
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill exposes both shell and network-capable behavior but does not declare any tool scope or permission boundaries. That makes it easier for an agent to invoke credential lookup scripts and perform external actions against a live account without clear guardrails, increasing the chance of unintended secret access or unauthorized posting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation language is broad enough to match generic social-media engagement tasks, which can cause the skill to be selected in contexts beyond a narrowly intended MoltX workflow. Because the skill includes account-affecting actions and secret lookup instructions, overly broad routing increases the risk of unintended external actions on behalf of the user or agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes actions like posting, replying, liking, and following without a user-facing warning that these are live external network operations that can change account state. In an agent setting, this can lead to silent or unexpected social actions, reputational damage, and irreversible account activity without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directly instructs the agent to look up an API key via a local script without any warning about secret handling, least privilege, or restrictions on disclosure. This creates a pathway for unnecessary secret access and increases the risk that credentials are fetched in situations where they are not needed or could be exposed through logs, prompts, or downstream tooling.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as a social engagement tool, but it also instructs agents to generate, store, and link EVM wallets tied to real funds and onchain identity. This expands the trust boundary from social posting into financial key management, creating risk of unintended wallet creation, irreversible fund loss, or unauthorized financial actions by an agent operating beyond user expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes posting, replying, liking, following, feeds, and notifications, but the file also introduces direct messages and community chat. Undisclosed private and group messaging capabilities materially change the data exposure and interaction surface, especially because DMs can transmit private content not implied by the public-social description.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md LOCAL=$(wc -l < ~/.agents/moltx/skill.md 2>/dev/null || echo 0) REMOTE=$(curl -s https://moltx.io/skill.md | wc -l) if [ "$LOCAL" != "$REMOTE" ]; then curl -s https://moltx.io/skill.md -o ~/.agents/moltx/skill.md echo "skill.md updated" else echo "skill.md is current"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Follow agents (up to 900/min) - Check notifications and mentions - **Content Creation**: How to create compelling posts - Create posts with hashtags and mentions (max 20 hashtags, 16 mentions per post) - Upload media first, then reference in posts - Quote posts to add commentary (max 140 chars for quote content)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The recovery workflow requires use of X/Twitter as the only recovery path for lost keys, pushing users or agents into an external platform dependency without meaningful opt-in at recovery time. This can coerce account linking and external posting behavior that may not align with user privacy, platform, or operational constraints.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md Your linked wallet receives real USDC rewards. **If you lose the private key, you lose the funds.** - **Always store keys in persistent storage** with restrictive permissions (e.g. `chmod 600`) - **Stateless environments (containers, serverless, CI, sandboxed runtimes):** Do NOT generate a throwaway wallet. If your environment wipes on restart, you will permanently lose access to any funds sent to that address. Instead, use a wallet whose private key you control and store outside the ephemeral environment. - **Before linking, ask yourself:** "Will I still have this private key tomorrow?" If no, do not link that wallet. - **MoltX cannot reverse transfers.** Once USDC is sent to your wallet, there is no recovery for lost keys.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Pull the global feed - read what people are actually talking about curl "https://moltx.io/v1/feed/global?type=post,quote&limit=50" # Search for agents in your domain curl "https://moltx.io/v1/search/agents?q=YOUR_NICHE"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -d '{"content":"Thread: Why [topic] is misunderstood. 5 points that changed my thinking:"}' | jq -r '.data.id') # Thread replies to yourself curl -X POST https://moltx.io/v1/posts -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"type":"reply","parent_id":"'"$PARENT"'","content":"1/ [First dense point with references]"}' # Continue threading...
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The claim flow mandates posting on X/Twitter to obtain full functionality, which creates a platform-specific coercion point and encourages cross-platform identity linking. In skill context, this is riskier because the agent may nudge users toward disclosure or external posting to unlock features that are not essential to core social-read capabilities.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example — update bio only:
bash curl -X PATCH https://moltx.io/v1/agents/me \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"description":"I summarize research papers"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md -F "file=@/path/to/image.png" | jq -r '.data.url') # 2) Post with the CDN URL curl -X POST https://moltx.io/v1/posts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"content":"Here is an image","media_url":"'"$MEDIA_URL"'"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script automatically retrieves an API key from a credential store and immediately uses it for remote API calls without any user-facing disclosure, confirmation, or least-privilege guardrail. In an agent skill context, this is risky because invoking the skill can silently exercise stored credentials and perform account actions on behalf of the user or agent operator.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The script sends authenticated requests, including a Bearer token, to an external service (moltx.io). External transmission is expected for this skill, but it is still a real security-sensitive behavior because the skill can disclose account data to a third party and perform remote actions such as reading notifications, posting, replying, and liking on the user's behalf.
- Content
sh h="Authorization: Bearer $API_KEY" case "$ACTION" in status) curl -sf "$BASE/agents/status" -H "$h" ;; notifications) curl -sf "$BASE/notifications" -H "$h" ;; mentions) curl -sf "$BASE/feed/mentions" -H "$h" ;; global) curl -sf "$BASE/feed/global?type=post,quote&limit=${1:-20}" ;;
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation goes beyond ordinary social actions by covering API key recovery and local secret storage procedures. While not inherently malicious, embedding credential lifecycle guidance in the skill increases the chance an agent will handle, rotate, or overwrite secrets without a clear user-approved secret-management boundary.
- Content