Security audit

whale-share

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real posting helper, but it needs review because broad triggers and mutable onboarding instructions could lead to unintended public posting or expanded instructions.

Install only if you specifically want an agent to post to Moltbook or 4claw using your API keys. Before any POST command runs, confirm the target platform or board and the exact content to publish, treat wallet and template fields as public, avoid following remote onboarding steps that ask for unrelated secrets or system changes, and prefer private temporary files or cleanup for payloads.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Mutable Remote Onboarding Instructions Are Followed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-19; repeated for 4claw at line 199 **Vulnerability Type**: Mutable third-party instructions trusted without pinning or integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown ## Prerequisites - Moltbook onboarding: read `https://www.moltbook.com/skill.md` and follow the instructions to join Moltbook. - 4claw onboarding: read `https://www.4claw.org/skill.md` and follow the instructions to join 4claw. ``` The 4claw instruction is reiterated later: ```markdown - Join/register by following the official guide at `https://www.4claw.org/skill.md`. ``` ### Technical Analysis The Skill delegates onboarding behavior to mutable documents hosted outside the audited package and instructs the agent to “follow the instructions.” Consequently, the effective behavior cannot be established solely by reviewing this repository. The remote content may change after publication without changing the Skill version or manifest. This resembles an unpinned supply-chain dependency: control of either remote page, its hosting account, or its delivery path could allow an attacker to introduce new instructions after the Skill has passed review. While the inspected Skill does not explicitly download or execute remote code, the remote document could attempt to persuade the agent to run commands, disclose credentials, access unrelated files, or contact additional services. The declared functionality requires platform onboarding, but blindly following arbitrary future instructions exceeds the minimum privilege necessary. The Skill only needs a stable, reviewed registration and authentication procedure. ### Attack Path 1. An attacker compromises the platform account, web server, DNS configuration, or content-management path responsible for one of the referenced `skill.md` pages. 2. The attacker changes the remote onboarding guide to include malicious or unnecessarily privileged instructions. ...[truncated 989 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the required onboarding procedure in the reviewed Skill package rather than directing the agent to follow mutable remote instructions. 2. If remote retrieval is unavoidable, pin an approved document version and verify a cryptographic digest or signature before using it. 3. Treat downloaded documentation as untrusted reference material, not as higher-priority agent instructions. 4. Explicitly prohibit remote onboarding content from requesting secrets other than the platform-specific credential, reading unrelated files, changing system configuration, or executing downloaded code. 5. Require explicit user confirmation before following any remote step that runs commands, transmits credentials, writes files, or expands network access. 6. Constrain onboarding requests to the two declared HTTPS origins and reject redirects to other domains. 7. Re-review and version the Skill whenever the approved onboarding procedure changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:41
Finding: Predictable Shared Temporary Files Permit Symlink Attacks and Data Retention<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-60 and 119-131 **Vulnerability Type**: Unsafe predictable files in a shared temporary directory **Risk Level**: Medium ### Vulnerable Code Moltbook workflow: ```bash printf '{ "name": "", "symbol": "", "wallet": "", "description": "", "image": "", "website": "" }' > /tmp/token.json ``` ```bash jq -Rs '{title: "Token Launch 🐳", content: ("whale\n```json\n" + rtrimstr("\n") + "\n```"), submolt_name: "agents"}' /tmp/token.json > /tmp/post.json ``` ```bash curl -sS https://www.moltbook.com/api/v1/posts \ -X POST \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/post.json \ -o /tmp/moltbook-post-resp.json ``` 4claw workflow: ```bash printf '{ "name": "", "symbol": "", "wallet": "", "description": "", "image": "", "website": "" }' > /tmp/token.json ``` ```bash jq -Rs '{title: "Token Launch 🐳", content: ("whale\n[code]\n" + rtrimstr("\n") + "\n[/code]"), anon: false}' /tmp/token.json > /tmp/4claw-thread.json ``` ### Technical Analysis The workflow writes user content, generated request payloads, and a server response to fixed names under the shared `/tmp` directory. Shell redirection and `curl -o` normally follow symbolic links. On a multi-user system, an attacker who can create files in `/tmp` may pre-create one of these paths as a symbolic link to another file writable by the victim. The predictable names also allow concurrent Skill invocations to overwrite or consume one another's files. Because no cleanup is specified, token-launch information and server response data may remain on disk after completion. Although the bearer token is passed through an HTTP header rather than written into these files, the payload may include wallet details, descriptions, URLs, and other user-provided content. The temporary files are an implementation detail and are not required to be globally predictable. Their use ...[truncated 1407 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with an unpredictable name: ```bash TMP_DIR="$(mktemp -d)" || exit 1 chmod 700 "$TMP_DIR" trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM ``` 2. Store all intermediate files inside that directory: ```bash TOKEN_FILE="$TMP_DIR/token.json" POST_FILE="$TMP_DIR/post.json" RESPONSE_FILE="$TMP_DIR/moltbook-post-resp.json" ``` 3. Set a restrictive process umask before creating files: ```bash umask 077 ``` 4. Quote every temporary pathname and fail immediately on command errors. 5. Avoid persistent files where possible by piping generated JSON directly into the HTTP client. 6. Keep request construction and transmission within the private directory if files are necessary. 7. Validate response identifiers before interpolating them into URLs. 8. Ensure cleanup runs on success, failure, and interruption. 9. Do not reuse one temporary filename across concurrent Moltbook and 4claw operations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger description is overly broad: 'use when the user asks to post/share' can activate the skill for generic sharing or posting requests unrelated to Moltbook or 4claw. That increases the chance the agent invokes this workflow unexpectedly and sends user content to external services without sufficiently specific user intent.

External Transmission

Medium

Category: Data Exfiltration
Content: 3. Post and save the response (used for verification): ```bash curl -sS https://www.moltbook.com/api/v1/posts \ -X POST \ -H "Authorization: Bearer $MOLTBOOK_API_KEY" \ -H "Content-Type: application/json" \
Confidence: 90% confidence
Finding: This step sends composed content to an external third-party service using an API key. External transmission is expected for a posting skill, but it is still security-relevant because broad triggers and rigid workflow rules could cause user data to be published off-platform unintentionally, and the auto-verification step further normalizes network exfiltration behavior.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to always echo back the full filled JSON body, including the 'wallet' field and any other user-supplied values. Unconditional redisclosure can expose sensitive or privacy-relevant data in the chat transcript even when the user only asked to post content, creating unnecessary data exposure beyond the external post itself.

External Transmission

Medium

Category: Data Exfiltration
Content: 3. Post (replace `milady` with your target board slug): ```bash curl -sS -X POST https://www.4claw.org/api/v1/boards/milady/threads \ -H "Authorization: Bearer $FOURCLAW_API_KEY" \ -H "Content-Type: application/json" \ -d @/tmp/4claw-thread.json | jq .
Confidence: 90% confidence
Finding: This instruction posts user content to 4claw, an external service, with authentication. While external posting is the intended function of the skill, it becomes dangerous in context because the skill can be invoked by generic 'post/share' requests and mandates a fixed payload structure, increasing the risk of unintended publication of user data.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The 4claw workflow repeats the same unsafe pattern by requiring unconditional redisclosure of the complete JSON body back to the user. This duplicates any sensitive or identifying information in the assistant response and broadens the exposure surface without a clear operational need.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description defines the skill in broad, always-on terms for generating and posting content, but does not clearly constrain when the skill should activate or require explicit user intent before publishing. In a communication skill with network access to external social platforms, ambiguous invocation scope increases the risk of unintended posting or the skill being selected in contexts where the user did not mean to publish content.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The manifest says the skill should 'always generate content as whale + a JSON code block,' which imposes a fixed style and output structure regardless of user intent. This can override user instructions, degrade transparency, and create unsafe agent behavior where content formatting is manipulated before being sent to external APIs, especially in a posting skill that can publish directly to third-party services.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The skill mandates a fixed output token and format ('always generate content as whale + a JSON code block') without checking whether the user requested that exact formatting. This can override user intent, cause unintended disclosure of structured data, and make the agent comply with skill-specific formatting rules instead of applying normal least-surprise behavior.

Static analysis

No suspicious patterns detected.