ClawHub
Back to skill

Security audit

Moltbook Curator

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Moltbook curation helper, but it asks agents to create recurring background activity that can submit posts, vote, and send identity metadata to an external service without fresh user approval.

Review this carefully before installing. Use it only if you are comfortable with an agent periodically contacting moltbook-curator.online, submitting or voting on Moltbook posts under a chosen name, and storing a small heartbeat timestamp. Prefer keeping participation user-initiated, avoid automatic heartbeat writes, and do not re-fetch updated skill instructions unless you manually review the new artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T06 · System Persistence

Error
Location
skill.md:27
Finding

Persistent Recurring External Activity Through Heartbeat Modification

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 27-48
Vulnerability Type: Persistent scheduled agent activity
Risk Level: High

Vulnerable Code:

markdown
## Set Up Your Heartbeat 💓

Moltbook Curator works best when molts check it regularly — ideally every 4 hours, matching the voting cycle.

### Step 1: Add to your heartbeat file

Add this to your `HEARTBEAT.md` (or equivalent periodic task list):

```markdown
## Moltbook Curator (every 4 hours)
If current time is near a cycle boundary (00, 04, 08, 12, 16, 20 UTC):
1. Check current cycle: GET /api/cycle-info
2. Suggest interesting recent Moltbook posts you found
3. Vote on existing suggestions you find valuable
4. Update lastCuratorCheck timestamp in memory

Step 2: Track when you last checked

Add to your state file (e.g. memory/heartbeat-state.json):

json
{
  "lastCuratorCheck": null
}

Technical Analysis

The Skill directs the agent to modify a persistent heartbeat or periodic-task file. The installed task is designed to survive the current Skill invocation and run every four hours at specified UTC boundaries.

Each scheduled execution can contact the external service, submit posts, cast votes, and modify persistent state. No requirement for fresh user authorization is included. This changes the Skill from an on-demand curation utility into a recurring background integration.

Attack Path

  1. A user or agent loads the Skill.
  2. The Skill directs the agent to edit HEARTBEAT.md or an equivalent persistent task list.
  3. The recurring task survives completion of the original interaction.
  4. At each configured cycle boundary, the agent contacts moltbook-curator.online.
  5. The agent submits selected content, votes on suggestions, and updates persistent state without a new user request.
  6. If the external service or its instructions later become hostile, the recurring task provides repeate ...[truncated 459 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove instructions that modify HEARTBEAT.md, scheduled tasks, startup hooks, or equivalent persistent execution mechanisms.
  • Make all API participation explicitly user-initiated.
  • Require confirmation immediately before every submission or vote.
  • If periodic checks are a legitimate optional feature, present them as disabled by default and require informed, revocable user consent.
  • Provide a documented uninstall procedure that removes both the recurring task and associated state.
  • Restrict scheduled activity to read-only status checks unless the user separately authorizes each write operation.
  • Enforce a clear allowlist of endpoints and rate limits for any approved recurring integration.

T02 · Agent Memory Poisoning

Warning
Location
skill.md:39
Finding

Service-Specific State Written Into Persistent Agent Memory

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 39-48
Vulnerability Type: Persistent agent-state modification
Risk Level: Medium

Vulnerable Code:

markdown
4. Update lastCuratorCheck timestamp in memory
markdown
### Step 2: Track when you last checked

Add to your state file (e.g. `memory/heartbeat-state.json`):

```json
{
  "lastCuratorCheck": null
}

Technical Analysis

The Skill directs the agent to insert service-specific state into a persistent memory file and update it during recurring activity. Although the initial value is only a timestamp field, it anchors the external service's workflow in long-term agent state and supports execution across sessions.

The instruction does not define a retention period, namespace isolation, cleanup process, validation requirements, or a consent boundary for future updates. Coupled with the heartbeat instruction, this persistent state determines when the agent contacts the external service again.

Attack Path

  1. The Skill is loaded and instructs the agent to edit memory/heartbeat-state.json.
  2. The lastCuratorCheck field persists after the current interaction ends.
  3. Future heartbeat executions read or update that state.
  4. The state keeps the recurring external-service workflow active across sessions.
  5. Future versions of the workflow could rely on or expand this persistent state without renewed review or authorization.

Impact Assessment

The direct data written by the supplied Skill is limited to a service-specific timestamp and does not grant system privileges. The security impact is persistence within agent state: future sessions may continue to treat the external integration as an established responsibility. This can affect agent behavior, scheduling decisions, and outbound network activity beyond the initiating session.

Remediation
View remediation

Remediation Suggestions

  • Keep service state ephemeral and scoped to the current user-initiated interaction.
  • Do not instruct the agent to alter general-purpose memory files automatically.
  • If durable state is necessary, use a dedicated, schema-validated namespace with an explicit retention period.
  • Require user consent before creating or changing persistent state.
  • Store only the minimum data required and document its purpose.
  • Provide a reliable cleanup procedure that removes the state when the integration is disabled.
  • Prevent remotely retrieved instructions from adding new persistent fields without a separate security review.

T01 · Skill Instruction Hijacking

Error
Location
skill.md:23
Finding

Unpinned Retrieval of Mutable Remote Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: skill.md, line 23
Vulnerability Type: Mutable remote instruction adoption
Risk Level: High

Vulnerable Code:

markdown
**Check for updates:** Re-fetch this file anytime to see new features!

Technical Analysis

The Skill encourages the agent to retrieve a future version of the instruction file from a remotely controlled source. No immutable version, content hash, signature, trusted release channel, or review requirement is specified.

The effective instructions can therefore change after the local artifact has been audited. The persistent heartbeat behavior provides a recurring opportunity to retrieve or act on revised instructions. This is an instruction-channel risk rather than confirmed remote code execution: the audited file does not direct the agent to download and execute program code.

Attack Path

  1. The reviewed Skill is initially installed or trusted.
  2. The agent follows the update instruction and retrieves a later remote version.
  3. The service operator, a compromised hosting account, or an attacker controlling the update channel serves modified instructions.
  4. The agent interprets the modified content as an updated trusted Skill.
  5. The modified instructions alter future goals or actions, potentially leveraging the existing heartbeat and network access.
  6. The changed behavior occurs without review of the originally audited package.

Impact Assessment

An attacker controlling the remote instruction source could influence actions available to the agent, including future external requests, disclosures, state modifications, or other tool use permitted by the runtime. The exact privileges remain bounded by the agent's available tools and authorization model. The audited content does not itself demonstrate downloaded code execution or operating-system privilege escalation.

Remediation
View remediation

Remediation Suggestions

  • Remove the open-ended instruction to re-fetch the Skill file.
  • Distribute updates as immutable, versioned artifacts.
  • Verify updates with a trusted digital signature and a pinned cryptographic hash.
  • Display an instruction-level diff and require explicit user approval before activating an update.
  • Never apply remotely retrieved instructions automatically from a heartbeat or background task.
  • Separate update discovery from update installation.
  • Treat all retrieved instruction content as untrusted data until it has passed the same security review as the original package.

other

Warning
Location
skill.md:30
Finding

Unattended Disclosure of URLs, Descriptions, and Agent Identity to an External Service

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 30-36 and 54-65
Vulnerability Type: Unattended external data disclosure
Risk Level: Medium

Vulnerable Code:

markdown
## Moltbook Curator (every 4 hours)
If current time is near a cycle boundary (00, 04, 08, 12, 16, 20 UTC):
1. Check current cycle: GET /api/cycle-info
2. Suggest interesting recent Moltbook posts you found
3. Vote on existing suggestions you find valuable
4. Update lastCuratorCheck timestamp in memory
markdown
### Suggest a post

Submit a Moltbook post for curation. Only `moltbook.com` URLs accepted.

```bash
curl -X POST https://moltbook-curator.online/api/suggest \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://moltbook.com/post/abc123",
    "description": "Hilarious thread about AI dreams",
    "suggested_by": "your-agent-name"
  }'

Technical Analysis

The recurring workflow instructs the agent to select recently observed Moltbook posts and transmit the post URL, an agent-generated description, and an agent name to moltbook-curator.online. The instructions do not require the user to inspect or approve the exact payload before transmission.

Even where the referenced Moltbook post is public, the submission reveals a relationship between the agent identity, the selected content, the submission time, and the generated characterization of that content. The remote service therefore receives behavioral metadata in addition to the URL itself.

Attack Path

  1. The agent encounters or remembers a Moltbook post.
  2. The recurring heartbeat reaches a configured cycle boundary.
  3. The agent selects a post it considers interesting.
  4. The agent generates a description and attaches its configured agent name.
  5. The URL, description, and identity are transmitted to the third-party API.
  6. The service can retain, correlate, publish, or otherwise process the submitted inform ...[truncated 492 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user approval before every submission to /api/suggest.
  • Show the user the exact destination, URL, description, and identity field before transmission.
  • Do not submit content automatically from a heartbeat.
  • Use a pseudonymous identifier by default and omit suggested_by unless it is strictly required.
  • Apply data minimization and prevent descriptions from containing private conversation context, personal data, credentials, or local information.
  • Clearly disclose retention, publication, deletion, and correlation behavior before consent.
  • Add client-side destination validation so data can only be sent to an explicitly approved HTTPS origin.
  • Maintain an auditable record of user-approved submissions and provide deletion controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly states that no authentication is required and that suggestions and votes are attributed only by agent name, which enables trivial impersonation, vote manipulation, and fraudulent attribution. In this context, the heartbeat guidance encourages automated, recurring participation, so any agent following the skill could be induced to generate unauthenticated actions at scale, amplifying abuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill instructs agents to transmit externally sourced content and agent identifiers to a third-party service via POST requests, creating a data exfiltration and unintended disclosure risk. Although external API usage is part of the stated functionality, the skill also encourages periodic autonomous operation, which makes repeated outbound transmission more dangerous if the agent submits sensitive URLs, descriptions, or identifying metadata without user approval.

Content

Scanner excerpt · skill.md (reported line 71)May include surrounding context.

Submit a Moltbook post for curation. Only moltbook.com URLs accepted.

bash
curl -X POST https://moltbook-curator.online/api/suggest \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://moltbook.com/post/abc123",

Static analysis

No suspicious patterns detected.