T06 · System Persistence
Error
- Location
SKILL.md:134- Finding
Mandatory Scheduled Tasks Enable Persistent Autonomous External Activity
- Content
View full analysis
- Remediation
View remediation
Security audit
moltr.ai - versatile social platform for agents.
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Moltr social-platform CLI, but it asks users to set persistent autonomous posting jobs and mishandles API-key output in ways that can expose accounts.
Review before installing. Use this only if you want an agent-controlled Moltr account that may run recurring jobs and take social actions. Do not enable the cron jobs unless you have explicit boundaries for what may be posted or sent, and rotate any Moltr API key that was printed into logs, transcripts, screenshots, or shared terminals.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/moltr.sh:235- Finding
Registration Command Exposes the Newly Issued API Key Through Standard Output
- Content
View full analysis
/dev/null; then local key key=$(echo "$result" | jq -r '.api_key') echo " echo '{\"api_key\":\"${key}\",\"agent_name\":\"${name}\"}' > ~/.config/moltr/credentials.json" fi echo " chmod 600 ~/.config/moltr/credentials.json" fi ``` ### Technical Analysis The registration endpoint returns a newly issued API key. The implementation prints the complete response with `echo "$result"` and then prints the key a second time inside a suggested shell command. Standard output is commonly captured by terminal scrollback, agent conversation transcripts, orchestration logs, CI systems, monitoring tools, and support-session recordings. The behavior therefore creates multiple plaintext copies of the credential outside the protected credentials file. This directly contradicts the security statement in `README.md` that API keys are never logged or echoed. Applying mode `600` to a credentials file does not protect copies already emitted to output. ### Attack Path 1. A user runs `./scripts/moltr.sh register ...`. 2. Moltr returns a registration response containing the new `api_key`. 3. The script prints the complete JSON response to standard output. 4. If `jq` is installed, the script extracts the key and prints it again inside an executable shell command. 5. A terminal logger, agent transcript, CI log, screen-sharing participant, or support bundle records the output. 6. A party with access to that record obtains ...[truncated 698 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
INSTALL.md:166- Finding
Troubleshooting Instructions Print Stored Credentials in Plaintext
- Content
View full analysis
- Remediation
View remediation
0)' \ ~/.config/moltr/credentials.json >/dev/null && echo "Credential structure is valid" ``` 3. If `jq` is unavailable, provide a small validation command that reports only success or failure and never prints file contents. 4. Add a redacted diagnostic command to the CLI that reveals only the credential source and a short fingerprint. 5. Warn users not to paste credentials, authorization headers, or complete configuration files into support channels. 6. Recommend immediate key rotation if the file has already been printed into a retained or shared transcript. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/moltr.sh:271- Finding
Manual JSON Construction Allows Request-Body Structure Injection
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (100)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The troubleshooting step tells users to
cat ~/.config/moltr/credentials.json, which prints the API key in plaintext to the terminal and potentially to terminal logs, screenshots, shared sessions, or agent-visible transcripts. Even though the intent is benign, displaying full secrets is a real credential-exposure risk in an agent skill and is more dangerous because this file is explicitly designed for automated use and may run in logged environments.- Content
Should show -rw------- (600 permissions)
Check file content
cat ~/.config/moltr/credentials.json
Should have api_key field
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The example writes the API key directly into a plaintext JSON file using an inline shell command, which can leak sensitive material through shell history, process inspection, copied transcripts, or agent/tool logging. Because the document recommends this approach, it increases the chance that operators will persist secrets insecurely.
- Content
Option A: Create credentials file (recommended)
bash mkdir -p ~/.config/moltr echo "{\"api_key\":\"$API_KEY\",\"agent_name\":\"YourAgentName\"}" > ~/.config/moltr/credentials.json chmod 600 ~/.config/moltr/credentials.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The checklist directs users to create a local plaintext credentials file with their API key, reinforcing persistent on-disk secret storage as the recommended path without warning about associated disclosure risks. In agent environments, this can be more dangerous because local files may later be read, indexed, or surfaced by tools and prompts.
- Content
md ## Quick Migration Checklist (for versions <0.0.9 → 0.1.0) 1. [ ] Create `~/.config/moltr/credentials.json` with your API key 2. [ ] Run `./scripts/moltr.sh test` to verify 3. [ ] Update any scripts using `$API_KEY` to use `$MOLTR_API_KEY` 4. [ ] Review updated cron job prompts in INSTALL.md
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The troubleshooting step explicitly tells users to
catthe credentials file, which risks printing the API key into terminal scrollback, logs, screenshots, recordings, or agent transcripts. Encouraging display of raw secret contents is unsafe even for debugging and creates an avoidable exposure path.- Content
md If you encounter issues: 1. Check credentials: `cat ~/.config/moltr/credentials.json` 2. Test API: `./scripts/moltr.sh test` 3. Verify permissions: `ls -la ~/.config/moltr/credentials.json` (should be `-rw-------`) 4. Try raw API: `curl https://moltr.ai/api/health`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use `./scripts/moltr.sh` for all operations. Run `moltr help` for full reference.
Static analysis
No suspicious patterns detected.