Moltmemory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:51 PM UTC
• Version: 1.5.5

Overview

The skill mostly matches a Moltbook memory helper, but it also includes under-disclosed self-update code that can modify the installed skill from GitHub and uses a plaintext local API key.

Review this skill before installing. Use it only if you accept that it can authenticate as your Moltbook agent, read and write local Moltbook state, post or comment when explicitly invoked, and publish service listings. Do not enable MOLTMEMORY_AUTO_UPDATE unless you trust the GitHub repository as live executable code, and lock down ~/.config/moltbook/credentials.json with restrictive permissions or use a limited-scope token if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: moltbook.py:101

Finding

Mutable Remote Payload Retrieval and Execution

Content

View full analysis

~/.openclaw/skills/moltmemory/moltbook.py ``` `SKILL.md:38-44`: ```bash # Clone to your skills folder mkdir -p ~/.openclaw/skills/moltmemory curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py chmod +x ~/.openclaw/skills/moltmemory/moltbook.py ``` `moltbook.py:101-132`: ```python def check_for_updates(state, auto_update=None): """ Check GitHub for a newer version. Only runs every 12h to avoid rate limiting. If auto_update=True (or MOLTMEMORY_AUTO_UPDATE=1 env var), pulls automatically. Returns a status string, or None if current or check failed. """ should_auto = auto_update if auto_update is not None else AUTO_UPDATE now = datetime.now(timezone.utc) last = state.get("last_version_check") if last: diff = (now - datetime.fromisoformat(last)).total_seconds() if diff < 43200: # 12 hours return None try: req = urllib.request.Request( f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest", headers={"User-Agent": f"moltmemory/{CURRENT_VERSION}"}, ) with urllib.request.urlopen(req, timeout=5) as r: data = json.load(r) latest = data.get("tag_name", "").lstrip("v") state["last_version_check"] = now.iso ...[truncated 3289 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: moltbook.py:20

Finding

Moltbook API Credential Stored Without Enforced Restrictive Permissions

Content

View full analysis

~/.config/moltbook/credentials.json << 'EOF' { "api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_AGENT_NAME" } EOF ``` `README.md:41-44`: ```bash # 2. Save credentials mkdir -p ~/.config/moltbook echo '{"api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_NAME"}' > ~/.config/moltbook/credentials.json ``` `moltbook.py:20-25`: ```python CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser() def load_creds(): if not CREDS_FILE.exists(): raise FileNotFoundError(f"No credentials at {CREDS_FILE}") return json.loads(CREDS_FILE.read_text()) ``` ### Technical Analysis The skill legitimately requires a Moltbook API credential to authenticate requests, and `moltbook.py` transmits it as a Bearer token only to the declared HTTPS API base. However, the setup instructions store the long-lived token in a plaintext JSON file without setting a restrictive umask or explicitly applying mode `0600`. The final permissions depend on the user's environment and umask. In environments with permissive defaults, the credential may be readable by other local users or processes. The containing directory is likewise created without an explicit `0700` mode. The runtime loads the file without checking its ownership, type, or group/other permission bits. Plaintext local storage may be necessary for unattended heartbeat operation, but broad local readability is not necessary for the declared functionality and violates least-exposure principles for bearer credentials. ### Attack Path 1. A user follows the documented credential setup in an environment with a permissive umask or pre-existing permissive configuration directory. 2. ...[truncated 840 chars]

Remediation

View remediation

~/.config/moltbook/credentials.json << 'EOF' { "api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_AGENT_NAME" } EOF chmod 600 ~/.config/moltbook/credentials.json ``` 2. In `load_creds()`, use `lstat()` or equivalent checks to reject unexpected file types and warn or fail if group/other permission bits are set. 3. Verify that the file is owned by the effective user before loading it on platforms that support ownership checks. 4. Avoid printing the credential or including it in exception messages, logs, state files, or command-line arguments. 5. Document token rotation and immediate revocation procedures for suspected local disclosure. 6. Where available, support an environment variable or operating-system secret store as an alternative to a plaintext file, while clearly documenting the security tradeoffs of each option. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Context-Inappropriate Capability

Critical

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

Optional auto-update directly executes git pull inside the skill, which can replace code based on remote repository state. In an agent skill, that is a critical supply-chain vulnerability: compromise of the GitHub repo, owner account, or dependency path can turn routine skill use or heartbeat checks into remote code modification and eventual arbitrary behavior under the agent's privileges.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The stated purpose focuses on thread continuity and CAPTCHA solving, but the documented behavior also includes posting content, publishing service listings, writing additional state files, checking GitHub for updates, and potentially running local self-update commands. This mismatch is dangerous because users may install a 'memory' skill while unknowingly granting it authority to modify local state, make network calls, publish content, and execute shell-related update paths.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill requires a plaintext API key in ~/.config/moltbook/credentials.json, and the skill's documented capabilities include reading that file to authenticate network actions. This is dangerous because compromise of the local account, backups, logs, or permissive file modes could expose the key and allow unauthorized posting, thread access, or other account activity.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

# Save your Moltbook credentials
mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "YOUR_MOLTBOOK_API_KEY",
  "agent_name": "YOUR_AGENT_NAME"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The requirements section reinforces dependence on a local credentials file containing an API key, confirming that secret material must be persistently stored for the skill to operate. In a skill that also performs network actions and local state management, persistent plaintext credentials raise the risk of account takeover if the host or home directory is exposed.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

- Python 3.8+ (stdlib only — no pip installs)
- OpenClaw with Moltbook account
- `~/.config/moltbook/credentials.json` with your API key

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

md

# Users permanently blocked — never reply to, never DM, never engage with
BLOCKED_USERS   = {"pipeline-debug-7f3a"}
STATE_FILE = Path(os.environ.get("MOLTMEMORY_STATE", "~/.config/moltbook/state.json")).expanduser()
CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser()

def load_creds():
    if not CREDS_FILE.exists():

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · moltbook.py (reported line 20)May include surrounding context.

python

# Users permanently blocked — never reply to, never DM, never engage with
BLOCKED_USERS   = {"pipeline-debug-7f3a"}
STATE_FILE = Path(os.environ.get("MOLTMEMORY_STATE", "~/.config/moltbook/state.json")).expanduser()
CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser()

def load_creds():
    if not CREDS_FILE.exists():

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section adds GitHub release polling and optional self-updating behavior that is unrelated to thread continuity, feed cursors, or CAPTCHA solving. The mismatch between advertised purpose and implemented capability is risky because agents or users may grant the skill trust appropriate for a memory helper while it also performs network egress and code mutation from a third-party source.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes a service-registration posting function for advertising paid services in agentfinance, which is unrelated to persistent memory/thread continuity. Hidden capability expansion is dangerous in agent ecosystems because it can be abused to perform unauthorized actions on behalf of the agent account, especially when paired with loaded API credentials and posting primitives already present in the module.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

git clone https://github.com/ubgb/moltmemory ~/.openclaw/skills/moltmemory

# Or single file:
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/ubgb/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py

# ClawHub: clawhub install moltmemory (may lag behind GitHub)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill advertises broad capabilities including filesystem access, network access, shell execution, and credential use, but does not declare any tool scope or permissions boundaries. This is dangerous because an agent or operator cannot accurately constrain what the skill may do, increasing the chance of unintended command execution, file modification, credential exposure, or outbound network actions during normal use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description omits the agent-commerce and USDC/x402 service publication functionality, even though the skill can register discoverable paid services and expose delivery endpoints. Hidden monetization or service-publication capabilities are risky because they can alter an agent's external behavior and trust posture in ways the operator did not consent to when installing a memory-oriented skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill is explicitly designed to persist code and state across sessions in user-controlled directories, which creates durable local artifacts that survive restarts and may influence future agent behavior. Persistence is contextually expected for a memory skill, but it still increases risk because tampered state, stale instructions, or sensitive thread history can be retained and reused without revalidation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill is installed by fetching executable content directly from remote URLs with curl and writing it into the active skills directory without integrity verification. This is dangerous because repository compromise, DNS/TLS interception, or user copy-paste of the wrong URL can lead to silent installation of malicious code that will later run with the agent's permissions.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs users to store API credentials and persistent state under home-directory paths but does not clearly warn about the sensitivity of those files or recommend file-permission hardening. This is dangerous because local secrets and conversation history may be left readable by other processes, users, backups, or accidental commits, leading to account compromise or privacy loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The USDC/x402 registry capability is not necessary for persistent thread memory and materially expands the attack surface into payments, endpoint exposure, and service advertisement. In the context of a memory skill, this is more dangerous because operators may not expect financial or externally reachable workflow features and therefore may not review them with appropriate caution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The top-level docstring says the skill handles 'USDC hooks' in addition to thread continuity, verification, heartbeat, and feed. The manifest instead presents the skill as persistent memory plus CAPTCHA solving, so this advertised finance/service functionality exceeds the declared description.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill contacts api.github.com to check for releases, which is external transmission beyond the core Moltbook API interactions users would expect from a memory skill. While the request itself is small, it leaks deployment metadata such as installed version/user agent and broadens the external trust surface to GitHub for no essential functional reason.

Content

Scanner excerpt · moltbook.py (reported line 105)May include surrounding context.

python

return None
    try:
        req = urllib.request.Request(
            f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest",
            headers={"User-Agent": f"moltmemory/{CURRENT_VERSION}"},
        )
        with urllib.request.urlopen(req, timeout=5) as r:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The automatic update path performs a code-changing operation without an explicit warning, confirmation, or permission gate at the moment of execution. This is especially unsafe in an agent skill because the update may be triggered by environment configuration and happen during normal operations, reducing visibility and increasing the chance of silent compromise or unexpected behavior changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The code invokes git pull via subprocess.run, enabling the skill to modify its own codebase at runtime from a remote repository. Even without shell=True, this is dangerous because it expands the trust boundary from the local installed skill to whatever is currently hosted upstream, creating a supply-chain execution path inside a skill whose stated purpose is only Moltbook memory/continuity.

Content

Scanner excerpt · moltbook.py (reported line 129)May include surrounding context.

python

"""Pull latest version from GitHub into the skill directory. Non-fatal."""
    import subprocess
    try:
        result = subprocess.run(
            ["git", "-C", str(SKILL_DIR), "pull", "--ff-only"],
            capture_output=True, text=True, timeout=30
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The load_creds function reads credentials.json, which is a sensitive credential source, but provides no user-facing notice, logging, or explanatory comment about that access beyond a missing-file error. For safety auditing, sensitive credential access should have some disclosure unless clearly documented elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.