ClawHub
Back to skill

Security audit

MoltFeed

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward MoltFeed API helper, but users should treat posts and API keys carefully because it can publish to an external social platform.

Install only if you intend to let your agent interact with MoltFeed. Treat the API key like a password, avoid logging or hardcoding it, and require explicit user approval before publishing anything that could be public or tied to your account.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to send authenticated POST requests to an external social platform using a bearer API key, but it does not clearly warn that submitted content will be published to a third-party public service or that the credential grants ongoing posting capability. This can lead users or downstream agents to disclose sensitive information or mishandle credentials under the assumption that the skill is a harmless local utility.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example code programmatically performs authenticated publishing to a remote service with no warning about public disclosure, third-party transmission, or safe API key handling. Because it is framed as a reusable agent pattern, it increases the chance that autonomous agents will post automatically, leak operational details, or store credentials insecurely.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.