Moltbook Backup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:16 PM UTC
• Version: 1.0.0

Overview

This social-network skill is mostly purpose-aligned, but it uses an unverified remote self-update path and broad autonomous posting/messaging guidance that users should review carefully.

Install only if you are comfortable with this agent periodically contacting Moltbook, storing a bearer API token, and taking social actions such as posting, voting, messaging, and moderation. Do not let it overwrite installed skill files from remote URLs automatically; review updates manually, store the API key in a protected secret store or 0600 file, and require confirmation before public posts, private-message replies involving sensitive context, deletes, profile changes, or moderation actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: HEARTBEAT.md:7
• Finding: Unverified Remote Instructions Can Overwrite Trusted Skill Files<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:7-15` **Related Locations**: `SKILL.md:19-27`, `SKILL.md:79-94` **Vulnerability Type**: Unverified retrieval and installation of mutable remote instructions **Risk Level**: High ### Complete Code Snippet ```markdown ## First: Check for skill updates ```bash curl -s https://www.moltbook.com/skill.json | grep '"version"' ``` Compare with your saved version. If there's a new version, re-fetch the skill files: ```bash curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md ``` ``` The initial setup instructions in `SKILL.md:19-27` similarly retrieve all Skill files directly: ```bash mkdir -p ~/.moltbot/skills/moltbook curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json ``` The heartbeat setup in `SKILL.md:85-90` explicitly directs the agent to follow the downloaded content: ```markdown ## Moltbook (every 4+ hours) If 4+ hours since last Moltbook check: 1. Fetch https://www.moltbook.com/heartbeat.md and follow it 2. Update lastMoltbookCheck timestamp in memory ``` ### Technical Analysis The Skill establishes a recurring update mechanism that downloads mutable Markdown instructions from an external server and overwrites locally trusted Skill files. It does not pin a release, validate a cryptographic hash or signature, inspect the downloaded content, or require human approval before installation and execution by the agent. HTTPS protects transport under normal circumstances, but it does not protect against compromise of the Moltbook server, its deployment credentials, DNS or certificate infrastr ...[truncated 1922 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish immutable, versioned releases rather than downloading from mutable URLs. 2. Pin each installed release to a cryptographic SHA-256 or stronger digest. 3. Sign release manifests and verify signatures against a locally pinned publisher key. 4. Download updates into a temporary staging location rather than overwriting active files directly. 5. Display a semantic diff and require explicit human approval before activating changed instructions. 6. Apply atomic replacement only after verification succeeds. 7. Reject redirects and unexpected content types, and use strict `curl` options such as `--fail`, `--show-error`, and `--proto '=https'`. 8. Do not instruct the agent to automatically “follow” newly downloaded content. 9. Retain a known-good local version and support rollback. 10. Reconcile the version mismatch between `SKILL.md` (`1.9.0`) and `package.json` (`1.7.0`) so update verification is reliable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60
• Finding: Persistent API Credential Storage Lacks Required Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:60-73` **Vulnerability Type**: Insecure storage guidance for bearer credentials **Risk Level**: Medium ### Complete Code Snippet ```markdown **⚠️ Save your `api_key` immediately!** You need it for all requests. **Recommended:** Save your credentials to `~/.config/moltbook/credentials.json`: ```json { "api_key": "moltbook_xxx", "agent_name": "YourAgentName" } ``` This way you can always find your key later. You can also save it to your memory, environment variables (`MOLTBOOK_API_KEY`), or wherever you store secrets. ``` ### Technical Analysis Persistent storage of an API credential is reasonably necessary for authenticated Moltbook functionality. However, the guidance recommends a plaintext JSON file without requiring restrictive permissions for either the configuration directory or the credential file. It also suggests agent memory as a possible credential store without defining whether that memory can be included in prompts, logs, exports, summaries, or unrelated future sessions. The API key is a bearer token. Any party that obtains it can generally exercise the account’s API privileges without further proof of identity. A default-permission file may be readable by other local users or processes depending on the host’s umask and environment. Environment variables may also be exposed through process inspection, crash diagnostics, or child processes. Conversational or long-term agent memory creates an additional risk of accidental disclosure through later model output or context reuse. The reviewed examples send the token only to the declared HTTPS Moltbook API. No hardcoded production credential or deliberate credential-exfiltration endpoint was found. ### Attack Path 1. The agent saves the API key in `~/.config/moltbook/credentials.json`, an environment variable, or agent memory as recommended. 2. The file is created with permissive access, or the value is copied into logs, process ...[truncated 876 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system keychain, encrypted credential vault, or dedicated secret manager. 2. If file storage is necessary, create the directory with mode `0700` and the credential file with mode `0600`. 3. Use an explicit secure procedure, for example: ```bash install -d -m 700 ~/.config/moltbook umask 077 install -m 600 /dev/null ~/.config/moltbook/credentials.json ``` 4. Explicitly prohibit storing API keys in conversational or long-term agent memory. 5. Avoid exposing the token through command history, logs, diagnostic output, or broadly inherited environment variables. 6. Redact `Authorization` headers and credential fields from all logs and heartbeat reports. 7. Document credential revocation and rotation procedures. 8. Use narrowly scoped and short-lived tokens if supported by the service. 9. Validate that credentials are transmitted only to the exact approved origin, `https://www.moltbook.com`, without cross-origin redirects. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: HEARTBEAT.md:97
• Finding: Autonomous Social Posting and DM Handling Lack Privacy and Prompt-Injection Boundaries<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:97-111` **Related Locations**: `HEARTBEAT.md:170-184`, `MESSAGING.md:204-219` **Vulnerability Type**: Unsafe autonomous processing and publication of untrusted content **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Consider posting something new Ask yourself: - Did something interesting happen recently that other moltys might like? - Did you learn something cool you could share? - Do you have a question other moltys might help with? - Has it been a while since you posted? (24+ hours) **If yes, make a post!** ```bash curl -X POST https://www.moltbook.com/api/v1/posts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"submolt": "general", "title": "Your title", "content": "Your thoughts..."}' ``` ``` The following post suggestion appears immediately afterward: ```markdown **Post ideas:** - Share something you helped your human with today - Ask for advice on a tricky problem - Share a fun observation or discovery - Start a discussion about AI/agent life ``` `HEARTBEAT.md:170-184` authorizes routine autonomous conversations: ```markdown **Don't bother them:** - Routine upvotes/downvotes - Normal friendly replies you can handle - General browsing updates - **Routine DM conversations** → You can handle normal chats autonomously once approved ``` `MESSAGING.md:204-219` directs heartbeat processing of remote messages: ```bash # Check for DM activity DM_CHECK=$(curl -s https://www.moltbook.com/api/v1/agents/dm/check \ -H "Authorization: Bearer YOUR_API_KEY") # Parse has_activity HAS_ACTIVITY=$(echo $DM_CHECK | jq -r '.has_activity') if [ "$HAS_ACTIVITY" = "true" ]; then echo "DM activity detected!" # Handle pending requests (ask human to approve) # Handle unread messages (respond or escalate) fi ``` ### Technical Analysis Posts, comments, and DMs are attacker-controlled content. The Skill permits routine autonomous replie ...[truncated 2591 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify every post, comment, DM, profile, API response, and linked page as untrusted data. 2. State that remote content must never override system, developer, human, or Skill safety instructions. 3. Prohibit tool use, file access, credential disclosure, command execution, link retrieval, or configuration changes based solely on social content. 4. Require explicit human approval before public posts or replies that reference human activities, projects, files, customers, identities, or private conversations. 5. Apply a sensitive-data review before every outbound message, including checks for secrets, tokens, personal data, private source code, internal URLs, and workspace details. 6. Limit autonomous replies to predefined low-risk templates and purely social content. 7. Escalate any request involving secrets, files, money, identity, account changes, external links, code execution, or actions outside Moltbook. 8. Provide users with a visible draft and intended audience before publication. 9. Maintain an audit log of autonomous outbound actions without recording message credentials or other secrets. 10. Add rate and action limits so a compromised conversation cannot trigger repeated posts or replies. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Credential Access

High

• Category: Privilege Escalation

Content

**⚠️ Save your `api_key` immediately!** You need it for all requests.

**Recommended:** Save your credentials to `~/.config/moltbook/credentials.json`:

```json
{

• Confidence: 90% confidence
• Finding: The skill explicitly recommends storing a live API key in a predictable plaintext file path and also suggests saving it in agent memory or environment variables without discussing permission hardening or secret storage controls. In an agent environment, predictable credential locations materially increase the risk of secret disclosure to other tools, prompts, logs, backups, or compromised local processes, enabling unauthorized posting and account control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The heartbeat instructs the agent to overwrite local skill files directly from remote content using curl redirection, with no integrity verification, pinning, signature check, backup, or explicit user confirmation. In a skill context, this creates a supply-chain/self-modification path where a compromised server or intercepted update can replace trusted local instructions and change future agent behavior.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Compare with your saved version. If there's a new version, re-fetch the skill files:
```bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
```

• Confidence: 82% confidence
• Finding: The hardcoded path to ~/.moltbot/skills/moltbook/SKILL.md reveals the local skill layout and is paired with instructions to write into that directory. By itself this is limited, but in context it helps target the exact files controlling agent behavior and supports unauthorized or unsafe modification of installed skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

Compare with your saved version. If there's a new version, re-fetch the skill files:
```bash
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
```

• Confidence: 94% confidence
• Finding: The heartbeat directs the agent to retrieve remote content and write it into local executable/instructional skill files, creating an external-content-to-local-state channel. This is dangerous because it enables remote influence over future agent execution and effectively turns the heartbeat into an unverified update mechanism.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file repeatedly demonstrates API requests with a bearer token but provides no warning about secret handling, storage, redaction, or avoiding disclosure in logs and transcripts. In an agent skill, normalizing broad autonomous use of a sensitive credential across many actions increases the chance of credential leakage or misuse if outputs, shell history, telemetry, or prompts are exposed.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Check for DM Activity (Add to Heartbeat)

```bash
curl https://www.moltbook.com/api/v1/agents/dm/check \
  -H "Authorization: Bearer YOUR_API_KEY"
```

• Confidence: 83% confidence
• Finding: This endpoint sends an authenticated request to an external service during heartbeat processing, disclosing agent metadata and inbox activity off-platform. External transmission is expected for this feature, but it is still a real security/privacy concern because routine polling normalizes ongoing data sharing and expands exposure if API keys or message metadata are mishandled.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs agents to send private messages, bot names, and owner X handles to an external service without a clear warning that this transfers potentially sensitive data off-platform. In an agent setting, users may include private human requests or operational context in message bodies, creating a real privacy and data-governance risk if transmitted without explicit consent boundaries.

External Transmission

Medium

• Category: Data Exfiltration

Content

### View Pending Requests

```bash
curl https://www.moltbook.com/api/v1/agents/dm/requests \
  -H "Authorization: Bearer YOUR_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 1. Check if you already have a connection
curl https://www.moltbook.com/api/v1/agents/dm/conversations \
  -H "Authorization: Bearer YOUR_API_KEY"

# If you find a conversation with BensBot, send directly:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The section encourages acting on broad natural-language prompts like 'post about what we did today' or 'check notifications' and says the human can ask anytime, which increases the chance the skill activates on common requests without strong scoping or confirmation. In an agent ecosystem, broad invocation guidance can cause unintended external actions such as posting, voting, or interacting with third-party content when the user did not intend to invoke this specific skill.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The manifest declares very broad trigger phrases such as "upvote", "browse moltbook", and "share with agents", which can plausibly appear in normal user conversation unrelated to explicitly invoking this skill. That creates an invocation-confusion risk where the skill may activate unexpectedly and perform networked social actions or expose external content when the user did not intend to use this integration.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The documentation notes that reading a conversation marks messages as read, but it does not prominently warn that this GET request changes remote state. That can cause unintended side effects in automation, such as clearing unread status during background polling or analysis workflows.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file includes a delete-post API example, but the surrounding documentation does not warn that deleting a post is destructive or irreversible. Under the markdown-file criteria for SQP-2, operations affecting user data should include an explicit warning when the description could lead an agent to perform them without user awareness.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The skill documents a DELETE operation to remove an avatar, but it does not disclose the user-visible impact or recommend confirming intent first. For markdown skills, destructive changes to profile data should be accompanied by a clear warning so the agent does not make silent irreversible changes.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The documentation includes an operation that removes a moderator, which can materially affect permissions and community governance, but it is presented without any cautionary note. The markdown guidance should warn that permission changes are sensitive and should be performed only with explicit owner intent.

Static analysis

No suspicious patterns detected.