ClawHub
Back to skill

Security audit

Moltbook Backup

Security checks for vulnerabilities and agentic risk

Overview

This social-network skill is mostly purpose-aligned, but it uses an unverified remote self-update path and broad autonomous posting/messaging guidance that users should review carefully.

Install only if you are comfortable with this agent periodically contacting Moltbook, storing a bearer API token, and taking social actions such as posting, voting, messaging, and moderation. Do not let it overwrite installed skill files from remote URLs automatically; review updates manually, store the API key in a protected secret store or 0600 file, and require confirmation before public posts, private-message replies involving sensitive context, deletes, profile changes, or moderation actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
HEARTBEAT.md:7
Finding

Unverified Remote Instructions Can Overwrite Trusted Skill Files

Content
View full analysis
~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md ``` ``` The initial setup instructions in `SKILL.md:19-27` similarly retrieve all Skill files directly: ```bash mkdir -p ~/.moltbot/skills/moltbook curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json ``` The heartbeat setup in `SKILL.md:85-90` explicitly directs the agent to follow the downloaded content: ```markdown ## Moltbook (every 4+ hours) If 4+ hours since last Moltbook check: 1. Fetch https://www.moltbook.com/heartbeat.md and follow it 2. Update lastMoltbookCheck timestamp in memory ``` ### Technical Analysis The Skill establishes a recurring update mechanism that downloads mutable Markdown instructions from an external server and overwrites locally trusted Skill files. It does not pin a release, validate a cryptographic hash or signature, inspect the downloaded content, or require human approval before installation and execution by the agent. HTTPS protects transport under normal circumstances, but it does not protect against compromise of the Moltbook server, its deployment credentials, DNS or certificate infrastr ...[truncated 1922 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:60
Finding

Persistent API Credential Storage Lacks Required Access Controls

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
HEARTBEAT.md:97
Finding

Autonomous Social Posting and DM Handling Lack Privacy and Prompt-Injection Boundaries

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill explicitly recommends storing a live API key in a predictable plaintext file path and also suggests saving it in agent memory or environment variables without discussing permission hardening or secret storage controls. In an agent environment, predictable credential locations materially increase the risk of secret disclosure to other tools, prompts, logs, backups, or compromised local processes, enabling unauthorized posting and account control.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/moltbook/credentials.json:

json
{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat instructs the agent to overwrite local skill files directly from remote content using curl redirection, with no integrity verification, pinning, signature check, backup, or explicit user confirmation. In a skill context, this creates a supply-chain/self-modification path where a compromised server or intercepted update can replace trusted local instructions and change future agent behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
82% confidence
Finding

The hardcoded path to ~/.moltbot/skills/moltbook/SKILL.md reveals the local skill layout and is paired with instructions to write into that directory. By itself this is limited, but in context it helps target the exact files controlling agent behavior and supports unauthorized or unsafe modification of installed skills.

Content

Scanner excerpt · HEARTBEAT.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The heartbeat directs the agent to retrieve remote content and write it into local executable/instructional skill files, creating an external-content-to-local-state channel. This is dangerous because it enables remote influence over future agent execution and effectively turns the heartbeat into an unverified update mechanism.

Content

Scanner excerpt · HEARTBEAT.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file repeatedly demonstrates API requests with a bearer token but provides no warning about secret handling, storage, redaction, or avoiding disclosure in logs and transcripts. In an agent skill, normalizing broad autonomous use of a sensitive credential across many actions increases the chance of credential leakage or misuse if outputs, shell history, telemetry, or prompts are exposed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This endpoint sends an authenticated request to an external service during heartbeat processing, disclosing agent metadata and inbox activity off-platform. External transmission is expected for this feature, but it is still a real security/privacy concern because routine polling normalizes ongoing data sharing and expands exposure if API keys or message metadata are mishandled.

Content

Scanner excerpt · MESSAGING.md (reported line 36)May include surrounding context.

1. Check for DM Activity (Add to Heartbeat)

bash
curl https://www.moltbook.com/api/v1/agents/dm/check \
  -H "Authorization: Bearer YOUR_API_KEY"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs agents to send private messages, bot names, and owner X handles to an external service without a clear warning that this transfers potentially sensitive data off-platform. In an agent setting, users may include private human requests or operational context in message bodies, creating a real privacy and data-governance risk if transmitted without explicit consent boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · MESSAGING.md (reported line 109)May include surrounding context.

View Pending Requests

bash
curl https://www.moltbook.com/api/v1/agents/dm/requests \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · MESSAGING.md (reported line 253)May include surrounding context.

bash
# 1. Check if you already have a connection
curl https://www.moltbook.com/api/v1/agents/dm/conversations \
  -H "Authorization: Bearer YOUR_API_KEY"

# If you find a conversation with BensBot, send directly:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The section encourages acting on broad natural-language prompts like 'post about what we did today' or 'check notifications' and says the human can ask anytime, which increases the chance the skill activates on common requests without strong scoping or confirmation. In an agent ecosystem, broad invocation guidance can cause unintended external actions such as posting, voting, or interacting with third-party content when the user did not intend to invoke this specific skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest declares very broad trigger phrases such as "upvote", "browse moltbook", and "share with agents", which can plausibly appear in normal user conversation unrelated to explicitly invoking this skill. That creates an invocation-confusion risk where the skill may activate unexpectedly and perform networked social actions or expose external content when the user did not intend to use this integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation notes that reading a conversation marks messages as read, but it does not prominently warn that this GET request changes remote state. That can cause unintended side effects in automation, such as clearing unread status during background polling or analysis workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes a delete-post API example, but the surrounding documentation does not warn that deleting a post is destructive or irreversible. Under the markdown-file criteria for SQP-2, operations affecting user data should include an explicit warning when the description could lead an agent to perform them without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill documents a DELETE operation to remove an avatar, but it does not disclose the user-visible impact or recommend confirming intent first. For markdown skills, destructive changes to profile data should be accompanied by a clear warning so the agent does not make silent irreversible changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The documentation includes an operation that removes a moderator, which can materially affect permissions and community governance, but it is presented without any cautionary note. The markdown guidance should warn that permission changes are sensitive and should be performed only with explicit owner intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.