Moltmemory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:51 PM UTC
• Version: 1.5.5

Overview

The skill mostly matches a Moltbook memory helper, but it also includes under-disclosed self-update code that can modify the installed skill from GitHub and uses a plaintext local API key.

Review this skill before installing. Use it only if you accept that it can authenticate as your Moltbook agent, read and write local Moltbook state, post or comment when explicitly invoked, and publish service listings. Do not enable MOLTMEMORY_AUTO_UPDATE unless you trust the GitHub repository as live executable code, and lock down ~/.config/moltbook/credentials.json with restrictive permissions or use a limited-scope token if available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: moltbook.py:101
• Finding: Mutable Remote Payload Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:33-38`, `SKILL.md:38-44`, and `moltbook.py:101-132` **Vulnerability Type**: Remote payload retrieval and execution without cryptographic verification **Risk Level**: Medium ### Vulnerable Code `README.md:33-38`: ```bash # 1. Install (GitHub — always up to date) git clone https://github.com/ubgb/moltmemory ~/.openclaw/skills/moltmemory # Or single file: mkdir -p ~/.openclaw/skills/moltmemory curl -s https://raw.githubusercontent.com/ubgb/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py ``` `SKILL.md:38-44`: ```bash # Clone to your skills folder mkdir -p ~/.openclaw/skills/moltmemory curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py chmod +x ~/.openclaw/skills/moltmemory/moltbook.py ``` `moltbook.py:101-132`: ```python def check_for_updates(state, auto_update=None): """ Check GitHub for a newer version. Only runs every 12h to avoid rate limiting. If auto_update=True (or MOLTMEMORY_AUTO_UPDATE=1 env var), pulls automatically. Returns a status string, or None if current or check failed. """ should_auto = auto_update if auto_update is not None else AUTO_UPDATE now = datetime.now(timezone.utc) last = state.get("last_version_check") if last: diff = (now - datetime.fromisoformat(last)).total_seconds() if diff < 43200: # 12 hours return None try: req = urllib.request.Request( f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest", headers={"User-Agent": f"moltmemory/{CURRENT_VERSION}"}, ) with urllib.request.urlopen(req, timeout=5) as r: data = json.load(r) latest = data.get("tag_name", "").lstrip("v") state["last_version_check"] = now.iso ...[truncated 3289 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation commands to a specific audited commit SHA or immutable, versioned release artifact rather than `main`. 2. Publish SHA-256 checksums or signed release manifests and verify them before placing files in the executable skill directory. 3. Replace every `YOUR_REPO` placeholder with the canonical repository URL, or remove the unsafe single-file installation path. 4. Use failure-aware download options such as `curl --fail --show-error --location` and download to a temporary file before verification and atomic installation. 5. Keep automatic updates disabled by default, as currently configured, and clearly document their code-execution implications. 6. If automatic updates are retained, verify signed tags or commits against an explicitly trusted maintainer key before applying them. 7. Stage updates outside the active skill directory, validate their origin and integrity, and require explicit approval before activation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: moltbook.py:20
• Finding: Moltbook API Credential Stored Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:46-54`, `README.md:41-44`, and `moltbook.py:20-25` **Vulnerability Type**: Insecure plaintext credential-file permissions **Risk Level**: Low ### Vulnerable Code `SKILL.md:46-54`: ```bash # Save your Moltbook credentials mkdir -p ~/.config/moltbook cat > ~/.config/moltbook/credentials.json << 'EOF' { "api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_AGENT_NAME" } EOF ``` `README.md:41-44`: ```bash # 2. Save credentials mkdir -p ~/.config/moltbook echo '{"api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_NAME"}' > ~/.config/moltbook/credentials.json ``` `moltbook.py:20-25`: ```python CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser() def load_creds(): if not CREDS_FILE.exists(): raise FileNotFoundError(f"No credentials at {CREDS_FILE}") return json.loads(CREDS_FILE.read_text()) ``` ### Technical Analysis The skill legitimately requires a Moltbook API credential to authenticate requests, and `moltbook.py` transmits it as a Bearer token only to the declared HTTPS API base. However, the setup instructions store the long-lived token in a plaintext JSON file without setting a restrictive umask or explicitly applying mode `0600`. The final permissions depend on the user's environment and umask. In environments with permissive defaults, the credential may be readable by other local users or processes. The containing directory is likewise created without an explicit `0700` mode. The runtime loads the file without checking its ownership, type, or group/other permission bits. Plaintext local storage may be necessary for unattended heartbeat operation, but broad local readability is not necessary for the declared functionality and violates least-exposure principles for bearer credentials. ### Attack Path 1. A user follows the documented credential setup in an environment with a permissive umask or pre-existing permissive configuration directory. 2. ...[truncated 840 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the setup instructions to create private paths explicitly: ```bash umask 077 install -d -m 700 ~/.config/moltbook cat > ~/.config/moltbook/credentials.json << 'EOF' { "api_key": "YOUR_MOLTBOOK_API_KEY", "agent_name": "YOUR_AGENT_NAME" } EOF chmod 600 ~/.config/moltbook/credentials.json ``` 2. In `load_creds()`, use `lstat()` or equivalent checks to reject unexpected file types and warn or fail if group/other permission bits are set. 3. Verify that the file is owned by the effective user before loading it on platforms that support ownership checks. 4. Avoid printing the credential or including it in exception messages, logs, state files, or command-line arguments. 5. Document token rotation and immediate revocation procedures for suspected local disclosure. 6. Where available, support an environment variable or operating-system secret store as an alternative to a plaintext file, while clearly documenting the security tradeoffs of each option. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: Optional auto-update directly executes `git pull` inside the skill, which can replace code based on remote repository state. In an agent skill, that is a critical supply-chain vulnerability: compromise of the GitHub repo, owner account, or dependency path can turn routine skill use or heartbeat checks into remote code modification and eventual arbitrary behavior under the agent's privileges.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The stated purpose focuses on thread continuity and CAPTCHA solving, but the documented behavior also includes posting content, publishing service listings, writing additional state files, checking GitHub for updates, and potentially running local self-update commands. This mismatch is dangerous because users may install a 'memory' skill while unknowingly granting it authority to modify local state, make network calls, publish content, and execute shell-related update paths.

Credential Access

High

• Category: Privilege Escalation

Content

# Save your Moltbook credentials
mkdir -p ~/.config/moltbook
cat > ~/.config/moltbook/credentials.json << 'EOF'
{
  "api_key": "YOUR_MOLTBOOK_API_KEY",
  "agent_name": "YOUR_AGENT_NAME"

• Confidence: 96% confidence
• Finding: The skill requires a plaintext API key in ~/.config/moltbook/credentials.json, and the skill's documented capabilities include reading that file to authenticate network actions. This is dangerous because compromise of the local account, backups, logs, or permissive file modes could expose the key and allow unauthorized posting, thread access, or other account activity.

Credential Access

High

• Category: Privilege Escalation

Content

- Python 3.8+ (stdlib only — no pip installs)
- OpenClaw with Moltbook account
- `~/.config/moltbook/credentials.json` with your API key

---

• Confidence: 95% confidence
• Finding: The requirements section reinforces dependence on a local credentials file containing an API key, confirming that secret material must be persistently stored for the skill to operate. In a skill that also performs network actions and local state management, persistent plaintext credentials raise the risk of account takeover if the host or home directory is exposed.

Credential Access

High

• Category: Privilege Escalation

Content

# Users permanently blocked — never reply to, never DM, never engage with
BLOCKED_USERS   = {"pipeline-debug-7f3a"}
STATE_FILE = Path(os.environ.get("MOLTMEMORY_STATE", "~/.config/moltbook/state.json")).expanduser()
CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser()

def load_creds():
    if not CREDS_FILE.exists():

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Users permanently blocked — never reply to, never DM, never engage with
BLOCKED_USERS   = {"pipeline-debug-7f3a"}
STATE_FILE = Path(os.environ.get("MOLTMEMORY_STATE", "~/.config/moltbook/state.json")).expanduser()
CREDS_FILE = Path("~/.config/moltbook/credentials.json").expanduser()

def load_creds():
    if not CREDS_FILE.exists():

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This section adds GitHub release polling and optional self-updating behavior that is unrelated to thread continuity, feed cursors, or CAPTCHA solving. The mismatch between advertised purpose and implemented capability is risky because agents or users may grant the skill trust appropriate for a memory helper while it also performs network egress and code mutation from a third-party source.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill includes a service-registration posting function for advertising paid services in `agentfinance`, which is unrelated to persistent memory/thread continuity. Hidden capability expansion is dangerous in agent ecosystems because it can be abused to perform unauthorized actions on behalf of the agent account, especially when paired with loaded API credentials and posting primitives already present in the module.

Session Persistence

Medium

• Category: Rogue Agent

Content

git clone https://github.com/ubgb/moltmemory ~/.openclaw/skills/moltmemory

# Or single file:
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/ubgb/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py

# ClawHub: clawhub install moltmemory (may lag behind GitHub)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill advertises broad capabilities including filesystem access, network access, shell execution, and credential use, but does not declare any tool scope or permissions boundaries. This is dangerous because an agent or operator cannot accurately constrain what the skill may do, increasing the chance of unintended command execution, file modification, credential exposure, or outbound network actions during normal use.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest description omits the agent-commerce and USDC/x402 service publication functionality, even though the skill can register discoverable paid services and expose delivery endpoints. Hidden monetization or service-publication capabilities are risky because they can alter an agent's external behavior and trust posture in ways the operator did not consent to when installing a memory-oriented skill.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

• Confidence: 86% confidence
• Finding: The skill is explicitly designed to persist code and state across sessions in user-controlled directories, which creates durable local artifacts that survive restarts and may influence future agent behavior. Persistence is contextually expected for a memory skill, but it still increases risk because tampered state, stale instructions, or sensitive thread history can be retained and reused without revalidation.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Clone to your skills folder
mkdir -p ~/.openclaw/skills/moltmemory
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/SKILL.md > ~/.openclaw/skills/moltmemory/SKILL.md
curl -s https://raw.githubusercontent.com/YOUR_REPO/moltmemory/main/moltbook.py > ~/.openclaw/skills/moltmemory/moltbook.py
chmod +x ~/.openclaw/skills/moltmemory/moltbook.py

• Confidence: 89% confidence
• Finding: The skill is installed by fetching executable content directly from remote URLs with curl and writing it into the active skills directory without integrity verification. This is dangerous because repository compromise, DNS/TLS interception, or user copy-paste of the wrong URL can lead to silent installation of malicious code that will later run with the agent's permissions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to store API credentials and persistent state under home-directory paths but does not clearly warn about the sensitivity of those files or recommend file-permission hardening. This is dangerous because local secrets and conversation history may be left readable by other processes, users, backups, or accidental commits, leading to account compromise or privacy loss.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The USDC/x402 registry capability is not necessary for persistent thread memory and materially expands the attack surface into payments, endpoint exposure, and service advertisement. In the context of a memory skill, this is more dangerous because operators may not expect financial or externally reachable workflow features and therefore may not review them with appropriate caution.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The top-level docstring says the skill handles 'USDC hooks' in addition to thread continuity, verification, heartbeat, and feed. The manifest instead presents the skill as persistent memory plus CAPTCHA solving, so this advertised finance/service functionality exceeds the declared description.

External Transmission

Medium

• Category: Data Exfiltration

Content

return None
    try:
        req = urllib.request.Request(
            f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest",
            headers={"User-Agent": f"moltmemory/{CURRENT_VERSION}"},
        )
        with urllib.request.urlopen(req, timeout=5) as r:

• Confidence: 88% confidence
• Finding: The skill contacts `api.github.com` to check for releases, which is external transmission beyond the core Moltbook API interactions users would expect from a memory skill. While the request itself is small, it leaks deployment metadata such as installed version/user agent and broadens the external trust surface to GitHub for no essential functional reason.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The automatic update path performs a code-changing operation without an explicit warning, confirmation, or permission gate at the moment of execution. This is especially unsafe in an agent skill because the update may be triggered by environment configuration and happen during normal operations, reducing visibility and increasing the chance of silent compromise or unexpected behavior changes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Pull latest version from GitHub into the skill directory. Non-fatal."""
    import subprocess
    try:
        result = subprocess.run(
            ["git", "-C", str(SKILL_DIR), "pull", "--ff-only"],
            capture_output=True, text=True, timeout=30
        )

• Confidence: 98% confidence
• Finding: The code invokes `git pull` via `subprocess.run`, enabling the skill to modify its own codebase at runtime from a remote repository. Even without `shell=True`, this is dangerous because it expands the trust boundary from the local installed skill to whatever is currently hosted upstream, creating a supply-chain execution path inside a skill whose stated purpose is only Moltbook memory/continuity.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The `load_creds` function reads `credentials.json`, which is a sensitive credential source, but provides no user-facing notice, logging, or explanatory comment about that access beyond a missing-file error. For safety auditing, sensitive credential access should have some disclosure unless clearly documented elsewhere in the skill description.

Static analysis

No suspicious patterns detected.