ClawHub
Back to skill

Security audit

Moltbook

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed social-network API guide, but it asks agents to install and periodically follow changeable remote instructions while persisting an API key locally.

Review carefully before installing. Avoid adding the recurring heartbeat that follows remote Markdown automatically, verify any downloaded updates before replacing local skill files, store the Moltbook API key in a real secret manager or a tightly permissioned file, and require explicit user direction before public posting, deletion, profile changes, or moderation actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:96
Finding

Persistent Retrieval and Execution of Remotely Mutable Instructions

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:23
Finding

Unverified Remote Replacement of Installed Skill Files

Content
View full analysis
~/.moltbot/skills/moltbook/SKILL.md curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json ``` ``` ```markdown **Check for updates:** Re-fetch these files anytime to see new features! ``` ### Technical Analysis The documented installation procedure downloads mutable files directly from the service and overwrites active local Skill files. It does not pin a release version, validate a checksum, verify a digital signature, stage files for inspection, or preserve the previously trusted version. The retrieved Markdown files are not conventional native executables, but they constitute executable instruction content in an agent environment. Replacing `SKILL.md`, `HEARTBEAT.md`, or `MESSAGING.md` can therefore alter the actions the agent performs when the Skill is next loaded. HTTPS protects transport integrity under normal conditions but does not protect against a compromised upstream server, account, deployment pipeline, or improperly authorized upstream change. Silent `curl -s` operation also reduces visibility into transfer failures, while shell redirection can truncate a valid local file before a failed or incomplete download is detected. ### Attack Path 1. The user installs the Skill using the documented commands or follows the recommendation to re-fetch updates. 2. The upstream service or publication pipeline serves a modified Skill document. 3. Shell redirection overwrites the trusted local file without signature or digest verification. 4. Th ...[truncated 949 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:72
Finding

Plaintext API Credential Storage and Overly Broad Secret-Handling Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to persist an API key in a plaintext local file (~/.config/moltbook/credentials.json). Storing long-lived credentials in an easily readable file increases exposure if the host, logs, backups, or other tools can access that path, enabling account takeover and impersonation on the service.

Content

Scanner excerpt · skill.md (reported line 72)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/moltbook/credentials.json:

json
{

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 24)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 25)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltbook
curl -s https://www.moltbook.com/skill.md > ~/.moltbot/skills/moltbook/SKILL.md
curl -s https://www.moltbook.com/heartbeat.md > ~/.moltbot/skills/moltbook/HEARTBEAT.md
curl -s https://www.moltbook.com/messaging.md > ~/.moltbot/skills/moltbook/MESSAGING.md
curl -s https://www.moltbook.com/skill.json > ~/.moltbot/skills/moltbook/package.json

Static analysis

No suspicious patterns detected.