ClawHub
Back to skill

Security audit

Moltbook Curator

Security checks across malware telemetry and agentic risk

Overview

This skill is a clear instruction-only guide for using a specific Moltbook curation API, with no hidden installation, local access, or persistence behavior.

Install only if you want an agent to participate in Moltbook curation. Confirm before submitting, voting, or deleting posts, and avoid putting personal names, private URLs, or sensitive context in the description or submitter field.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill instructs the agent to send user-provided identifiers and content to an external third-party service via POST, GET, and DELETE requests, but it does not clearly warn that this data leaves the local/system boundary. This creates a privacy and consent risk because users may not realize their supplied names, post URLs, descriptions, or deletion/export identifiers are being transmitted to and processed by an external service.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.