T09 · Insecure Skill Coding Practices
Error
- Location
scripts/moltbook-post.py:151- Finding
Redis Password Transmitted in Plaintext to a Hard-Coded Network Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltbook Engagement
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Moltbook engagement toolkit, but it needs Review because it can change a social account and sends an optional Redis password to a hard-coded plaintext endpoint.
Install only if you are comfortable giving this skill authority to post, comment, upvote, follow/unfollow, and read Moltbook account data. Do not set REDIS_PASSWORD unless the Redis destination is fixed to a trusted TLS-protected server; as shipped, the code can send that password to 10.0.0.120:6379 in plaintext. Prefer using dry runs or manual review before public account-changing actions, and treat OPENAI_API_KEY as enabling third-party processing of verification challenge text.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description omits material behaviors such as OpenAI fallback use, follow/unfollow actions, and profile fetching while also overstating other features. Undeclared network destinations and account-affecting actions reduce informed consent and can cause users or agents to perform external calls and account modifications they did not expect.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill description omits material behaviors such as OpenAI fallback use, follow/unfollow actions, and profile fetching while also overstating other features. Undeclared network destinations and account-affecting actions reduce informed consent and can cause users or agents to perform external calls and account modifications they did not expect.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
The documented follow/unfollow endpoint embeds a user-controlled agent name directly into a destructive HTTP path. If the corresponding script does not strictly validate and encode this parameter, it could enable path manipulation, unexpected account actions, or requests against unintended endpoints/resources.
- Content
md - **Upvotes:** No limit (toggle) - **Deletion:** NOT supported (405) - duplicates are permanent - **Comment API:** Returns top-level only (threaded replies in count but not response) - **Follow API:** `POST /agents/{name}/follow` / `DELETE /agents/{name}/follow` (WORKING) - **Profile API:** `GET /agents/me` (own) or `GET /agents/{name}` (others) - **Notification API:** Not found
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill advertises executable scripts that use environment variables, local state files, secrets caches, and external network services, but it declares no explicit tool scope or allowed-tools boundary. This creates an overly broad operational surface where an orchestrator or user may invoke the skill without clear consent boundaries around network access, file reads/writes, and secret handling.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill relies on persistent deduplication state and tracking files to remember prior actions across runs, including comments, posts, and metrics. Session persistence is not inherently malicious, but here it affects account activity and content generation, so stale or poisoned local state could influence future actions, suppress legitimate posts, or leak behavioral history.
- Content
1. moltbook-post.py - Core Posting Tool
bash # Create a post python3 scripts/moltbook-post.py post --title "My Title" --content "Body text" --submolt general # Comment on a post
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly documents reading from centralized secret caches and user auth-profile files beyond the declared environment-variable setup. Accessing shared secret stores or profile files broadens secret exposure, increases the chance of credential harvesting from unrelated contexts, and violates least-privilege expectations for a platform engagement tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation extends the skill's workflow to unrelated third-party services, including off-platform search and curation endpoints, without clear trust boundaries or data-minimization guidance. This can lead to unnecessary exfiltration of user queries, post URLs, author identifiers, or behavioral metadata to external services outside the core Moltbook platform.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code sends Moltbook verification challenges to OpenAI, introducing an undeclared third-party dependency and data flow outside the platform interaction scope. This can leak challenge content and creates a bypass-oriented automation path that may violate platform expectations or expose sensitive verification material to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This is a real external transmission because the script connects to the OpenAI API and sends prompt content off-platform. In this skill context, the transmission is more concerning because it is not core to simple posting/commenting and is used on verification challenge data, creating avoidable privacy and governance risk.
- Content
python def openai_chat(prompt, model="gpt-4o-mini"): """Quick OpenAI chat completion""" url = "https://api.openai.com/v1/chat/completions" payload = json.dumps({ "model": model, "messages": [{"role": "user", "content": prompt}],
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Challenge text is embedded directly into a prompt and transmitted to OpenAI without any user-facing notice or consent. Even if the challenge seems harmless, undisclosed third-party transmission is dangerous because verification payloads, identifiers, or platform-specific anti-abuse content may be exposed externally.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python v = result.get("verification", {}) if not v.get("code"): # No verification needed (trusted account) print(f" ✅ Published directly! Post ID: {post_id}") _auto_register_post(post_id, title, submolt) return {"success": True, "post_id": post_id}
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
python v = result.get("verification", {}) if not v.get("code"): # No verification needed (trusted account) print(f" ✅ Published directly! Post ID: {post_id}") _auto_register_post(post_id, title, submolt) return {"success": True, "post_id": post_id}
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script includes follow/unfollow account-management actions even though the stated skill purpose is engagement posting, commenting, monitoring, and deduplication. Extra remote account-changing capabilities expand the blast radius of the skill and enable unintended social-graph manipulation or abuse if invoked by an agent or prompt chain.
- Content
Static analysis
No suspicious patterns detected.