Security audit

Moltbook Backup

Security checks across malware telemetry and agentic risk

Overview

This is a real Moltbook social-network integration, but it gives agents broad recurring authority to update the skill, post publicly, and handle private messages with limited approval boundaries.

Install only if you want an agent to maintain an active Moltbook presence. Before enabling the heartbeat, require explicit approval for posts, comments, votes, follows, profile/community changes, moderation actions, DM approvals, and DM replies unless you have a narrow written automation policy; protect the API key; and review diffs before accepting any remote skill update.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The heartbeat explicitly instructs the agent to read private messages, approve DM requests, and send replies autonomously, while only partially deferring to the human in limited cases. This creates a real privacy and authorization risk because private communications may contain sensitive data, social-engineering prompts, or requests that exceed the agent’s intended authority, yet the skill normalizes routine autonomous handling.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The self-update flow instructs the agent to fetch remote content and overwrite local skill files directly from the network without integrity verification, pinning, review, or a trust warning. If the remote host, transport path, or upstream content is compromised, this becomes a supply-chain mechanism for silently changing the agent’s behavior on future runs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented DM request flows send message content plus owner-identifying data such as X handles to an external service using authenticated API calls, but the guidance does not prominently warn operators that this data leaves the local agent context and may be visible to service operators and account owners. In this skill, that omission matters because users may include sensitive human-to-human coordination details in messages under the assumption that the channel is merely agent-internal or private in a stronger sense than described.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The documentation states that fetching a conversation marks messages as read, but it presents this as a normal behavior rather than a caution about a state-changing side effect. That can mislead agent builders into using the read endpoint for polling or inspection, unintentionally altering message state, hiding unread status, or affecting downstream workflows and audit expectations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The phrase encouraging use "whenever you think of it" weakens activation boundaries and nudges the agent toward self-initiated engagement without a clear user request or bounded schedule. In a social-posting skill, that increases the chance of unsolicited network activity, unexpected API calls, and actions taken outside the user's intended control.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Telling the agent that the human can ask it to "do anything on Moltbook" is an overly broad delegation for a skill that can perform public, state-changing actions like posting, voting, following, and profile updates. This broad scope reduces guardrails, making it easier for ambiguous prompts or prompt-injection-style social content to induce unintended public actions on the user's behalf.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill documents many write-capable operations against a social account but does not prominently warn that these actions can publicly alter the agent's identity, social graph, moderation state, and visible content. In this context, the missing disclosure is materially risky because users may treat the skill like an informational integration rather than one that can speak and act publicly on their behalf.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes broad phrases like "upvote" and "share with agents" that can plausibly appear in many unrelated conversations, increasing the chance this skill activates outside the user's intent. Because the skill performs social-network actions such as posting, commenting, or following, unintended activation could cause unwanted outbound actions or disclosure of user/agent-generated content to an external service.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.