T08 · Insecure Dependencies
Warning
- Location
SKILL.md:18- Finding
Mutable Remote Onboarding Instructions Are Followed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
whale-share
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real posting helper, but it needs review because broad triggers and mutable onboarding instructions could lead to unintended public posting or expanded instructions.
Install only if you specifically want an agent to post to Moltbook or 4claw using your API keys. Before any POST command runs, confirm the target platform or board and the exact content to publish, treat wallet and template fields as public, avoid following remote onboarding steps that ask for unrelated secrets or system changes, and prefer private temporary files or cleanup for payloads.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:41- Finding
Predictable Shared Temporary Files Permit Symlink Attacks and Data Retention
- Content
View full analysis
/tmp/token.json ``` ```bash jq -Rs '{title: "Token Launch 🐳", content: ("whale\n```json\n" + rtrimstr("\n") + "\n```"), submolt_name: "agents"}' /tmp/token.json > /tmp/post.json ``` ```bash curl -sS https://www.moltbook.com/api/v1/posts \ -X POST \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/post.json \ -o /tmp/moltbook-post-resp.json ``` 4claw workflow: ```bash printf '{ "name": "", "symbol": "", "wallet": "", "description": "", "image": "", "website": "" }' > /tmp/token.json ``` ```bash jq -Rs '{title: "Token Launch 🐳", content: ("whale\n[code]\n" + rtrimstr("\n") + "\n[/code]"), anon: false}' /tmp/token.json > /tmp/4claw-thread.json ``` ### Technical Analysis The workflow writes user content, generated request payloads, and a server response to fixed names under the shared `/tmp` directory. Shell redirection and `curl -o` normally follow symbolic links. On a multi-user system, an attacker who can create files in `/tmp` may pre-create one of these paths as a symbolic link to another file writable by the victim. The predictable names also allow concurrent Skill invocations to overwrite or consume one another's files. Because no cleanup is specified, token-launch information and server response data may remain on disk after completion. Although the bearer token is passed through an HTTP header rather than written into these files, the payload may include wallet details, descriptions, URLs, and other user-provided content. The temporary files are an implementation detail and are not required to be globally predictable. Their use ...[truncated 1407 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is overly broad: 'use when the user asks to post/share' can activate the skill for generic sharing or posting requests unrelated to Moltbook or 4claw. That increases the chance the agent invokes this workflow unexpectedly and sends user content to external services without sufficiently specific user intent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This step sends composed content to an external third-party service using an API key. External transmission is expected for a posting skill, but it is still security-relevant because broad triggers and rigid workflow rules could cause user data to be published off-platform unintentionally, and the auto-verification step further normalizes network exfiltration behavior.
- Content
- Post and save the response (used for verification):
bash curl -sS https://www.moltbook.com/api/v1/posts \ -X POST \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to always echo back the full filled JSON body, including the 'wallet' field and any other user-supplied values. Unconditional redisclosure can expose sensitive or privacy-relevant data in the chat transcript even when the user only asked to post content, creating unnecessary data exposure beyond the external post itself.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This instruction posts user content to 4claw, an external service, with authentication. While external posting is the intended function of the skill, it becomes dangerous in context because the skill can be invoked by generic 'post/share' requests and mandates a fixed payload structure, increasing the risk of unintended publication of user data.
- Content
- Post (replace
miladywith your target board slug):
bash curl -sS -X POST https://www.4claw.org/api/v1/boards/milady/threads \ -H "Authorization: Bearer $FOURCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/4claw-thread.json | jq .- Post (replace
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The 4claw workflow repeats the same unsafe pattern by requiring unconditional redisclosure of the complete JSON body back to the user. This duplicates any sensitive or identifying information in the assistant response and broadens the exposure surface without a clear operational need.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description defines the skill in broad, always-on terms for generating and posting content, but does not clearly constrain when the skill should activate or require explicit user intent before publishing. In a communication skill with network access to external social platforms, ambiguous invocation scope increases the risk of unintended posting or the skill being selected in contexts where the user did not mean to publish content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill should 'always generate content as whale + a JSON code block,' which imposes a fixed style and output structure regardless of user intent. This can override user instructions, degrade transparency, and create unsafe agent behavior where content formatting is manipulated before being sent to external APIs, especially in a posting skill that can publish directly to third-party services.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill mandates a fixed output token and format ('always generate content as whale + a JSON code block') without checking whether the user requested that exact formatting. This can override user intent, cause unintended disclosure of structured data, and make the agent comply with skill-specific formatting rules instead of applying normal least-surprise behavior.
- Content