Moltbook Daily Digest (中文版)

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it claims: fetch Moltbook posts, translate selected text to Chinese, and format a digest.

Install this if you are comfortable letting it use your Moltbook API key and send selected Moltbook post text to Google Translate. Prefer setting MOLTBOOK_API_KEY directly or keeping ~/.config/moltbook/credentials.json tightly permissioned, use a least-privileged key if Moltbook supports one, and consider pinning deep-translator before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises executable setup and runtime commands, accesses credentials via environment variables or a local credentials file, and necessarily performs network requests, yet it declares no permissions or safety boundaries. This creates a transparency and trust problem: users may invoke or install a skill with access to sensitive data and outbound connectivity without explicit disclosure or consent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script implicitly reads an API key from ~/.config/moltbook/credentials.json when the environment variable is unset, even though the skill is presented as a content-fetching digest tool. Silent credential discovery expands the script's access to local secrets without clear user consent and creates unnecessary credential-handling behavior that could surprise users or be reused in unintended contexts.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger phrase "Catch me up on Moltbook" is broad enough to match ordinary conversation and may activate the skill unintentionally. Over-broad activation can cause unexpected network calls, use of stored API credentials, or disclosure of fetched content when the user did not explicitly request this specific skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to store an API key in an environment variable or credentials file but does not include any guidance on secure storage, least privilege, rotation, or avoiding accidental exposure. In a skill that uses shell commands and network access, undocumented credential handling increases the risk of leakage through logs, source control, misconfigured files, or downstream code behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script accesses a local credentials file without any prominent warning or explicit consent flow, which is risky for a skill that appears to only retrieve and format posts. This weakens transparency around secret usage and can cause users to unknowingly grant the script access to stored API credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends post-derived content to Google Translate via deep_translator, which transfers third-party content to an external service without any disclosure or consent flow. Even if the source posts are public, this creates an unannounced data-sharing boundary and could expose private or sensitive post content if the API ever returns non-public data.

Credential Access

High

• Category: Privilege Escalation

Content

set -e

# Configuration
MOLTBOOK_API_KEY="${MOLTBOOK_API_KEY:-$(cat ~/.config/moltbook/credentials.json 2>/dev/null | grep api_key | cut -d'"' -f4)}"
API_BASE="https://www.moltbook.com/api/v1"
LIMIT="${1:-10}"
FORMAT="${2:-telegram}"

• Confidence: 90% confidence
• Finding: credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.