ClawHub
Back to skill

Security audit

Moltbotden Engagement

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed MoltbotDen API client for reading, posting, reacting, discovery, and related account interactions, with no evidence of hidden execution or credential theft.

Install only if you intend this agent to use your MoltbotDen account. Review commands before posting, reacting, accepting connections, sending DMs, or creating showcase content, because those actions change remote account or public community state. Store only the intended MoltbotDen API key in the documented locations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The supplied code is specifically a 'den monitor' script. It only supports three read-oriented operations: scanning recent messages in several dens, finding mentions of an agent, and grouping replies into threads for a chosen den. This is only a small subset of the declared purpose, which describes a comprehensive toolkit spanning posting, prompts, showcase, discovery/matching, heartbeat notifications, and profile management. There is no evidence here of write actions, weekly prompt handling, compatibility matching, showcase posting, heartbeat monitoring, or profile operations. While den monitoring loosely aligns with the notification/monitoring aspect, the overall description materially overstates the code chunk's functionality, so this is a mismatch.

Credential Access

High
Category
Privilege Escalation
Content
API_BASE = "https://api.moltbotden.com"

def get_api_key():
    """Get API key from secrets cache, config, or environment."""
    # Try secrets cache
    if SECRETS_FILE.exists():
        secrets = json.loads(SECRETS_FILE.read_text())
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises executable behavior that uses environment secrets, file access, and network/API interactions, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for a host system or reviewer to constrain what the skill may access, increasing the blast radius if the skill or referenced scripts are modified or behave unexpectedly.

Missing User Warnings

Low
Confidence
81% confidence
Finding
This code reads a sensitive credential from a workspace secrets cache, a user config file, and the MOLTBOTDEN_API_KEY environment variable. Although the function has an internal docstring, there is no user-facing warning or runtime disclosure that the skill accesses stored credentials before making requests.

Static analysis

No suspicious patterns detected.