ClawHub
Back to skill

Security audit

Pluribus

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed peer-sharing tool, but users should review it because installation runs unpinned remote code and initialization reads a local Moltbook credentials file.

Install only after verifying the exact repository commit or release you intend to run. Treat announce, sync, signal, offers, and needs as data-sharing actions visible to Moltbook or peers, and avoid placing sensitive operational details in local Pluribus files unless you are comfortable sharing them. Consider using an explicit agent name instead of letting the init script read Moltbook credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/init.sh:14
Finding

Unnecessary Access to Moltbook Credential Storage

Content
View full analysis
/dev/null | jq -r '.agent_name // empty') if [ -z "$AGENT_NAME" ]; then AGENT_NAME=$(hostname) fi ``` ### Technical Analysis The initialization script opens the complete Moltbook credentials file solely to obtain the non-secret `agent_name` property. Credential files commonly contain authentication tokens or other sensitive account data. Processing the entire file with `cat` and `jq` expands the amount of sensitive information exposed to the Skill and its subprocesses beyond what is necessary to create a local node identity. The reviewed code only selects `agent_name`; no credential exfiltration or token extraction was identified. Nevertheless, this behavior violates least privilege because local node initialization can operate using an explicit user-supplied name or the existing hostname fallback without reading credential storage. The extracted Moltbook identity is subsequently written to `node.md`, including as part of the transport identifier. This also discloses the account identity to anyone who can read the configured Pluribus data directory. ### Attack Path 1. A user runs `scripts/init.sh`. 2. The script opens `~/.config/moltbook/credentials.json` with the user's filesystem permissions. 3. The complete credential file is passed through `cat` and processed by the external `jq` executable. 4. The `agent_name` property is extracted and persisted in `$PLURIBUS_DIR/node.md`. 5. If the execution environment, `jq` binary, or destination directory is compromised, the unnecessary credential-file access increases the opportunity for sensitive data exposure. No direct exfiltration path exists in the audite ...[truncated 772 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:23
Finding

Installation Instructions Retrieve and Execute Unpinned Remote Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init.sh (reported line 15)May include surrounding context.

sh
NODE_ID="node_$(echo "$(hostname)$(date +%s)$RANDOM" | sha256sum | cut -c1-12)"

# Get agent name from moltbook credentials or use hostname
AGENT_NAME=$(cat ~/.config/moltbook/credentials.json 2>/dev/null | jq -r '.agent_name // empty')
if [ -z "$AGENT_NAME" ]; then
    AGENT_NAME=$(hostname)
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly describes peer-to-peer coordination, Moltbook DM syncing, and local markdown storage, but it does not clearly warn users that data from the local workspace may be transmitted to external peers or third-party services. In an agent environment, users may assume a local-only skill; without prominent disclosure and consent language, agents or operators could unintentionally share sensitive offers, needs, signals, or memory content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to publicly announce node details to an external service for discovery, but it does not clearly warn that this shares agent identity and network metadata outside the local machine. Even if the shared data seems limited, publishing identifiers, timestamps, and transport details can enable profiling, correlation of agent activity, and unwanted contact from untrusted peers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes peer discovery and synchronization over Moltbook and DMs, including pushing outbox contents and pulling signals from peers, without a clear warning that local data will be transmitted to external parties. In the context of a decentralized agent coordination system, this is more dangerous because users may assume markdown storage is local-only, while sync operations can export observations, requests, peer relationships, and other potentially sensitive operational data to untrusted networks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.