T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:36- Finding
Mutable Remote Python Code Is Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Undersheet
Security checks for vulnerabilities and agentic risk
Overview
UnderSheet is a mostly coherent thread-tracking skill, but it adds high-impact account posting, CAPTCHA bypass, mutable remote install steps, and plaintext credential/session storage that users should review carefully before installing.
Install only if you need multi-platform thread tracking and are comfortable giving the skill access to the relevant platform accounts. Prefer read-only credentials where possible, avoid using the Moltbook CAPTCHA-solving posting flow, pin or verify downloaded code instead of installing from main, and lock credential/token/cookie files down with private directory and file permissions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
platforms/reddit.py:66- Finding
Credential, OAuth Token, and Session Cookie Files Lack Enforced Restrictive Permissions
- Content
View full analysis
~/.config/moltbook/credentials.json ``` ```bash echo '{"username": "YOUR_HN_USER", "password": "YOUR_HN_PASS"}' \ > ~/.config/undersheet/hackernews.json ``` The same pattern is used for Reddit, Discord, and Twitter credential files in `SKILL.md:64-88`. ### Technical Analysis Reddit OAuth responses, including the access token, are persisted with ordinary `open(..., "w")`. Hacker News authenticated cookies are persisted through `MozillaCookieJar.save`. Neither path explicitly creates the file with mode `0600`, verifies ownership, or corrects permissions on an existing file. The setup instructions similarly use shell redirection to create plaintext credential files without first requiring a private directory and restrictive file mode. Actual permissions therefore depend on the user's umask and pre-existing directory permissions. In environments with a permissive umask or shared home/configuration directories, another local account or process may be able to read reusable authentication material. Explicitly protecting locally stored secrets is necessary because these files contain passwords, API keys, bot tokens, OAuth secrets, access tokens, or authenticated session cookies ...[truncated 1507 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (42)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Advertising a Moltbook posting feature with a built-in CAPTCHA solver is far beyond a thread-memory function and indicates intentional support for bypassing an anti-automation control. In agent context, this creates elevated abuse potential because the skill could automate account actions on services that actively try to prevent such automation.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
A CAPTCHA solver is not justified by the stated memory-tracking purpose and is a strong indicator of anti-abuse circumvention capability. Such functionality is dangerous because it can help an autonomous agent evade platform protections and perform actions at scale under a user's credentials.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Undeclared proxy support, dynamic local adapter loading, and more complex reply-tracking behavior expand the attack surface beyond what the description suggests. In particular, dynamic adapter loading from the filesystem and proxy redirection can expose the agent to malicious local modules or third-party traffic interception if operators are not warned.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill explicitly requires access to credential files for multiple external services, which is a sensitive capability in an agent environment. While credential use is expected for authenticated integrations, it becomes dangerous because the skill also appears able to post content and make external calls, so compromise or misuse could lead to account takeover or unauthorized actions.
- Content
Moltbook:
bash echo '{"api_key": "YOUR_KEY", "agent_name": "YOUR_NAME"}' \ > ~/.config/moltbook/credentials.jsonHacker News (optional, read-only works without):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ UnderSheet — Moltbook platform adapter. Ports the MoltMemory skill into the UnderSheet adapter model. Credentials: ~/.config/moltbook/credentials.json { "api_key": "...", "agent_name": "..." } """
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python """ UnderSheet — Moltbook platform adapter. Ports the MoltMemory skill into the UnderSheet adapter model. Credentials: ~/.config/moltbook/credentials.json { "api_key": "...", "agent_name": "..." } """
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README presents the skill as persistent thread memory, but the supported-platform matrix expands scope to active posting across multiple services. That capability materially changes the trust model because a memory utility can now perform outbound actions on third-party platforms, increasing the chance of unauthorized posting or abuse if an agent invokes it automatically.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md -o ~/.openclaw/skills/undersheet/undersheet.py # Platform adapters (grab what you need) mkdir -p ~/.openclaw/skills/undersheet/platforms curl -fsSL https://raw.githubusercontent.com/ubgb/undersheet/main/platforms/moltbook.py \ -o ~/.openclaw/skills/undersheet/platforms/moltbook.py curl -fsSL https://raw.githubusercontent.com/ubgb/undersheet/main/platforms/hackernews.py \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README tells users to store usernames and passwords in plaintext JSON under a predictable path without any warning about file permissions, secret management, or safer alternatives. On multi-user systems, backups, logs, or malware exposure, these credentials could be trivially recovered and reused to access external accounts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README instructs users to place platform credentials in config files and exposes a posting API despite the skill being described primarily as memory/state management. This combination broadens the blast radius: compromise or misuse of the skill can lead not just to data access, but to authenticated actions on external accounts.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares no explicit tool scope or permissions despite clearly instructing use of network access, local file reads/writes, environment proxy variables, and credential files. In an agent ecosystem, this weakens reviewability and can cause the skill to be invoked with broader capabilities than users expect, increasing the chance of unauthorized data access or posting actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
A broad 'use when' description can cause automated agent planners to select this skill in loosely related contexts, even though it has credential, network, persistence, and possible posting capabilities. Over-broad routing increases the chance the skill is invoked unnecessarily, exposing local data or external accounts beyond user intent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The install flow fetches executable Python files directly from a remote repository into the agent's skill directory, enabling persistent code execution across sessions without integrity verification. If the upstream repository, network path, or referenced files are compromised, the agent can be backdoored persistently.
- Content
md curl -fsSL https://raw.githubusercontent.com/ubgb/undersheet/main/undersheet.py \ -o ~/.openclaw/skills/undersheet/undersheet.py mkdir -p ~/.openclaw/skills/undersheet/platforms curl -fsSL https://raw.githubusercontent.com/ubgb/undersheet/main/platforms/moltbook.py \ -o ~/.openclaw/skills/undersheet/platforms/moltbook.py curl -fsSL https://raw.githubusercontent.com/ubgb/undersheet/main/platforms/hackernews.py \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup section instructs users to place multiple platform credentials in local config files and implies persistent tracking data, but it does not provide a clear privacy/security warning about local storage of secrets and activity metadata. This omission can lead to unsafe file permissions, accidental backups of secrets, and underestimation of the sensitivity of agent interaction history.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code reads local Hacker News credentials and persistent session cookies so it can authenticate and act as the user, despite the skill being presented as memory-tracking infrastructure. In an agent setting, hidden access to local credentials broadens the blast radius significantly because any code path reaching posting logic can impersonate the user without separate authorization.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The adapter’s documented purpose is passive thread memory and feed tracking, but it also includes authenticated comment posting capability on Hacker News. This materially expands the skill’s authority from read-only state tracking to acting on behalf of the user, creating a scope mismatch that could enable unauthorized posting if the skill is invoked unexpectedly or repurposed by an agent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The adapter silently loads credentials, checks login state, performs login, and persists cookies without any user-facing disclosure or confirmation in code. In the context of an agent skill, this is dangerous because it normalizes covert authenticated behavior and can surprise users by reusing stored identity to perform actions they did not clearly authorize.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code performs authenticated network requests to a remote service using stored credentials without any visible consent, disclosure, or action gating. In an agent-skill context, silent authenticated network activity is risky because users may expect passive local memory behavior, not remote API interaction under their identity.
- Content
Static analysis
No suspicious patterns detected.