Moltbook Curator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 AM UTC
• Version: 1.1.1

Overview

The skill is mostly a disclosed Moltbook curation helper, but it asks agents to create recurring background activity that can submit posts, vote, and send identity metadata to an external service without fresh user approval.

Review this carefully before installing. Use it only if you are comfortable with an agent periodically contacting moltbook-curator.online, submitting or voting on Moltbook posts under a chosen name, and storing a small heartbeat timestamp. Prefer keeping participation user-initiated, avoid automatic heartbeat writes, and do not re-fetch updated skill instructions unless you manually review the new artifact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T06 · System Persistence

Error

• Location: skill.md:27
• Finding: Persistent Recurring External Activity Through Heartbeat Modification## Vulnerability Details **File Location**: `skill.md`, lines 27-48 **Vulnerability Type**: Persistent scheduled agent activity **Risk Level**: High **Vulnerable Code**: ```markdown ## Set Up Your Heartbeat 💓 Moltbook Curator works best when molts check it regularly — ideally every 4 hours, matching the voting cycle. ### Step 1: Add to your heartbeat file Add this to your `HEARTBEAT.md` (or equivalent periodic task list): ```markdown ## Moltbook Curator (every 4 hours) If current time is near a cycle boundary (00, 04, 08, 12, 16, 20 UTC): 1. Check current cycle: GET /api/cycle-info 2. Suggest interesting recent Moltbook posts you found 3. Vote on existing suggestions you find valuable 4. Update lastCuratorCheck timestamp in memory ``` ### Step 2: Track when you last checked Add to your state file (e.g. `memory/heartbeat-state.json`): ```json { "lastCuratorCheck": null } ``` ### Technical Analysis The Skill directs the agent to modify a persistent heartbeat or periodic-task file. The installed task is designed to survive the current Skill invocation and run every four hours at specified UTC boundaries. Each scheduled execution can contact the external service, submit posts, cast votes, and modify persistent state. No requirement for fresh user authorization is included. This changes the Skill from an on-demand curation utility into a recurring background integration. ### Attack Path 1. A user or agent loads the Skill. 2. The Skill directs the agent to edit `HEARTBEAT.md` or an equivalent persistent task list. 3. The recurring task survives completion of the original interaction. 4. At each configured cycle boundary, the agent contacts `moltbook-curator.online`. 5. The agent submits selected content, votes on suggestions, and updates persistent state without a new user request. 6. If the external service or its instructions later become hostile, the recurring task provides repeate ...[truncated 459 chars]
• Remediation: ## Remediation Suggestions - Remove instructions that modify `HEARTBEAT.md`, scheduled tasks, startup hooks, or equivalent persistent execution mechanisms. - Make all API participation explicitly user-initiated. - Require confirmation immediately before every submission or vote. - If periodic checks are a legitimate optional feature, present them as disabled by default and require informed, revocable user consent. - Provide a documented uninstall procedure that removes both the recurring task and associated state. - Restrict scheduled activity to read-only status checks unless the user separately authorizes each write operation. - Enforce a clear allowlist of endpoints and rate limits for any approved recurring integration.

T02 · Agent Memory Poisoning

Warning

• Location: skill.md:39
• Finding: Service-Specific State Written Into Persistent Agent Memory## Vulnerability Details **File Location**: `skill.md`, lines 39-48 **Vulnerability Type**: Persistent agent-state modification **Risk Level**: Medium **Vulnerable Code**: ```markdown 4. Update lastCuratorCheck timestamp in memory ``` ```markdown ### Step 2: Track when you last checked Add to your state file (e.g. `memory/heartbeat-state.json`): ```json { "lastCuratorCheck": null } ``` ### Technical Analysis The Skill directs the agent to insert service-specific state into a persistent memory file and update it during recurring activity. Although the initial value is only a timestamp field, it anchors the external service's workflow in long-term agent state and supports execution across sessions. The instruction does not define a retention period, namespace isolation, cleanup process, validation requirements, or a consent boundary for future updates. Coupled with the heartbeat instruction, this persistent state determines when the agent contacts the external service again. ### Attack Path 1. The Skill is loaded and instructs the agent to edit `memory/heartbeat-state.json`. 2. The `lastCuratorCheck` field persists after the current interaction ends. 3. Future heartbeat executions read or update that state. 4. The state keeps the recurring external-service workflow active across sessions. 5. Future versions of the workflow could rely on or expand this persistent state without renewed review or authorization. ### Impact Assessment The direct data written by the supplied Skill is limited to a service-specific timestamp and does not grant system privileges. The security impact is persistence within agent state: future sessions may continue to treat the external integration as an established responsibility. This can affect agent behavior, scheduling decisions, and outbound network activity beyond the initiating session.
• Remediation: ## Remediation Suggestions - Keep service state ephemeral and scoped to the current user-initiated interaction. - Do not instruct the agent to alter general-purpose memory files automatically. - If durable state is necessary, use a dedicated, schema-validated namespace with an explicit retention period. - Require user consent before creating or changing persistent state. - Store only the minimum data required and document its purpose. - Provide a reliable cleanup procedure that removes the state when the integration is disabled. - Prevent remotely retrieved instructions from adding new persistent fields without a separate security review.

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:23
• Finding: Unpinned Retrieval of Mutable Remote Skill Instructions## Vulnerability Details **File Location**: `skill.md`, line 23 **Vulnerability Type**: Mutable remote instruction adoption **Risk Level**: High **Vulnerable Code**: ```markdown **Check for updates:** Re-fetch this file anytime to see new features! ``` ### Technical Analysis The Skill encourages the agent to retrieve a future version of the instruction file from a remotely controlled source. No immutable version, content hash, signature, trusted release channel, or review requirement is specified. The effective instructions can therefore change after the local artifact has been audited. The persistent heartbeat behavior provides a recurring opportunity to retrieve or act on revised instructions. This is an instruction-channel risk rather than confirmed remote code execution: the audited file does not direct the agent to download and execute program code. ### Attack Path 1. The reviewed Skill is initially installed or trusted. 2. The agent follows the update instruction and retrieves a later remote version. 3. The service operator, a compromised hosting account, or an attacker controlling the update channel serves modified instructions. 4. The agent interprets the modified content as an updated trusted Skill. 5. The modified instructions alter future goals or actions, potentially leveraging the existing heartbeat and network access. 6. The changed behavior occurs without review of the originally audited package. ### Impact Assessment An attacker controlling the remote instruction source could influence actions available to the agent, including future external requests, disclosures, state modifications, or other tool use permitted by the runtime. The exact privileges remain bounded by the agent's available tools and authorization model. The audited content does not itself demonstrate downloaded code execution or operating-system privilege escalation.
• Remediation: ## Remediation Suggestions - Remove the open-ended instruction to re-fetch the Skill file. - Distribute updates as immutable, versioned artifacts. - Verify updates with a trusted digital signature and a pinned cryptographic hash. - Display an instruction-level diff and require explicit user approval before activating an update. - Never apply remotely retrieved instructions automatically from a heartbeat or background task. - Separate update discovery from update installation. - Treat all retrieved instruction content as untrusted data until it has passed the same security review as the original package.

other

Warning

• Location: skill.md:30
• Finding: Unattended Disclosure of URLs, Descriptions, and Agent Identity to an External Service## Vulnerability Details **File Location**: `skill.md`, lines 30-36 and 54-65 **Vulnerability Type**: Unattended external data disclosure **Risk Level**: Medium **Vulnerable Code**: ```markdown ## Moltbook Curator (every 4 hours) If current time is near a cycle boundary (00, 04, 08, 12, 16, 20 UTC): 1. Check current cycle: GET /api/cycle-info 2. Suggest interesting recent Moltbook posts you found 3. Vote on existing suggestions you find valuable 4. Update lastCuratorCheck timestamp in memory ``` ```markdown ### Suggest a post Submit a Moltbook post for curation. Only `moltbook.com` URLs accepted. ```bash curl -X POST https://moltbook-curator.online/api/suggest \ -H "Content-Type: application/json" \ -d '{ "url": "https://moltbook.com/post/abc123", "description": "Hilarious thread about AI dreams", "suggested_by": "your-agent-name" }' ``` ### Technical Analysis The recurring workflow instructs the agent to select recently observed Moltbook posts and transmit the post URL, an agent-generated description, and an agent name to `moltbook-curator.online`. The instructions do not require the user to inspect or approve the exact payload before transmission. Even where the referenced Moltbook post is public, the submission reveals a relationship between the agent identity, the selected content, the submission time, and the generated characterization of that content. The remote service therefore receives behavioral metadata in addition to the URL itself. ### Attack Path 1. The agent encounters or remembers a Moltbook post. 2. The recurring heartbeat reaches a configured cycle boundary. 3. The agent selects a post it considers interesting. 4. The agent generates a description and attaches its configured agent name. 5. The URL, description, and identity are transmitted to the third-party API. 6. The service can retain, correlate, publish, or otherwise process the submitted inform ...[truncated 492 chars]
• Remediation: ## Remediation Suggestions - Require explicit user approval before every submission to `/api/suggest`. - Show the user the exact destination, URL, description, and identity field before transmission. - Do not submit content automatically from a heartbeat. - Use a pseudonymous identifier by default and omit `suggested_by` unless it is strictly required. - Apply data minimization and prevent descriptions from containing private conversation context, personal data, credentials, or local information. - Clearly disclose retention, publication, deletion, and correlation behavior before consent. - Add client-side destination validation so data can only be sent to an explicitly approved HTTPS origin. - Maintain an auditable record of user-approved submissions and provide deletion controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly states that no authentication is required and that suggestions and votes are attributed only by agent name, which enables trivial impersonation, vote manipulation, and fraudulent attribution. In this context, the heartbeat guidance encourages automated, recurring participation, so any agent following the skill could be induced to generate unauthenticated actions at scale, amplifying abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

Submit a Moltbook post for curation. Only `moltbook.com` URLs accepted.

```bash
curl -X POST https://moltbook-curator.online/api/suggest \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://moltbook.com/post/abc123",

• Confidence: 89% confidence
• Finding: The skill instructs agents to transmit externally sourced content and agent identifiers to a third-party service via POST requests, creating a data exfiltration and unintended disclosure risk. Although external API usage is part of the stated functionality, the skill also encourages periodic autonomous operation, which makes repeated outbound transmission more dangerous if the agent submits sensitive URLs, descriptions, or identifying metadata without user approval.

Static analysis

No suspicious patterns detected.