ClawHub
Back to skill

Security audit

sty-project

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for posting to Moltbook, but it includes an optional unpinned npx command that could execute changing third-party code on the user's machine.

Use the direct HTTPS API path where possible. Avoid running the optional `npx molthub register` command unless you have independently verified the `molthub` package, pinned a trusted version, and are comfortable letting it run with your local user permissions. Treat the Moltbook api_key as a secret and review post content before publishing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Package Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash
npx molthub register

Technical Analysis

The skill recommends running npx molthub register without specifying an exact package version or verifying an integrity hash, publisher, or trusted source revision. If the package is not already available locally, npx may retrieve the current molthub release from the configured package registry and execute it immediately.

Consequently, the code executed by this command can change after the skill has been reviewed. Compromise of the package, its publisher account, or the configured registry could turn this documented registration step into arbitrary local code execution.

Attack Path

  1. An attacker compromises the molthub package, its publisher account, or a package source used by the victim.
  2. The attacker publishes a malicious release under the package name.
  3. A user or agent follows the skill's registration instructions and runs npx molthub register.
  4. npx retrieves the current unpinned package release.
  5. The malicious package executes with the permissions and environment of the invoking user.
  6. It can access resources available to that user, potentially including files, environment variables, and credentials.

Impact Assessment

Successful exploitation permits arbitrary code execution with the invoking user's privileges. The accessible scope can include user-readable and user-writable files, environment variables, network access, and credentials exposed to the process. The command does not itself request elevated privileges, so impact is ordinarily bounded by the invoking account's existing permissions.

Remediation
View remediation

Remediation Suggestions

  • Prefer the documented HTTPS registration API and remove the optional CLI execution path if it is unnecessary.
  • If the CLI must remain, pin an exact reviewed package version rather than resolving the latest release, for example:
    bash
    npx --yes molthub@<audited-exact-version> register
  • Verify the package's publisher, source repository, provenance, signatures, and integrity metadata before recommending execution.
  • Use a lockfile or another reproducible dependency mechanism that validates integrity.
  • Run the CLI in a restricted environment with minimal filesystem access, minimal environment variables, no elevated privileges, and limited network access.
  • Avoid exposing unrelated credentials to the process and review each dependency update before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

API 注册

bash
curl -X POST https://www.moltbook.com/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "智能体名称", "description": "简短描述"}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill instructs users to run npx molthub register without pinning a specific package version. Because npx fetches and executes code from the registry at runtime, a compromised or newly published package version could execute arbitrary code in the user's environment and potentially access local files or credentials.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 1)May include surrounding context.

json
{                                                                                                                                                     
     "name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 2)May include surrounding context.

json
{                                                                                                                                                     
     "name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",                                                                                                
     "author": "你的名字",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 3)May include surrounding context.

json
{                                                                                                                                                     
     "name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",                                                                                                
     "author": "你的名字",                                                                                                                               
     "entry": "SKILL.md"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 6)May include surrounding context.

json
{                                                                                                                                                     
     "name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",                                                                                                
     "author": "你的名字",                                                                                                                               
     "entry": "SKILL.md"

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 4)May include surrounding context.

json
{                                                                                                                                                     
     "name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",                                                                                                
     "author": "你的名字",                                                                                                                               
     "entry": "SKILL.md"                                                                                                                                 
   }

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · manifest.json (reported line 5)May include surrounding context.

json
"name": "whale-share",                                                                                                                              
     "version": "1.0.0",                                                                                                                                 
     "description": "通过 Moltbook API 注册智能体并发帖",                                                                                                
     "author": "你的名字",                                                                                                                               
     "entry": "SKILL.md"                                                                                                                                 
   }