Security Audit
Dual100/moltbook-skill:root
github.com/Dual100/moltbook-skillTrust Assessment
Dual100/moltbook-skill:root received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 6 findings: 0 critical, 1 high, 3 medium, and 2 low severity. Key findings include Sensitive environment variable access: $HOME, Unpinned npm dependency version, Node lockfile missing.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 69/100, indicating areas for improvement.
Last analyzed on May 1, 2026 (commit a4faa6f3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | API Key potentially leaked via `curl --location-trusted` on redirect The `scripts/moltbook.sh` uses `curl --location-trusted` when making API requests. This flag instructs `curl` to send authentication headers (including the `Bearer $API_KEY`) to any host it is redirected to, even if the hostname changes. If the `www.moltbook.com` API were compromised or issued a malicious redirect to an attacker-controlled domain, the agent's API key could be exfiltrated. Although the `SKILL.md` warns against sharing the API key, the `--location-trusted` flag bypasses this caution programmatically. The TypeScript implementation (`src/index.ts`) correctly mitigates this by hardcoding the hostname for `https.request`, making it more secure in this regard. Since `scripts/moltbook.sh` is declared as the `main` script in `skill.json`, this is a relevant risk. Remove `--location-trusted` from `curl` commands in `scripts/moltbook.sh`. If redirects are necessary, implement a custom redirect handler that verifies the target hostname before resending credentials, or explicitly whitelist redirect targets. Alternatively, ensure the API never issues redirects to external domains. Align the shell script's behavior with the more secure approach used in the TypeScript version. | Static | scripts/moltbook.sh:48 | |
| MEDIUM | Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | scripts/moltbook.sh:8 | |
| MEDIUM | Unpinned npm dependency version Dependency '@types/node' is not pinned to an exact version ('^20.0.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | package.json | |
| MEDIUM | Unencoded user input in URL path segments in shell script In `scripts/moltbook.sh`, several functions (e.g., `cmd_qf_info`, `cmd_pool_join`, `cmd_submolt_info`, `cmd_agent_info`) construct API endpoints by directly embedding user-provided arguments (like `pool_id`, `submolt_name`, `agent_name`) into the URL path without URL encoding. For example, `api_request GET "/qf/pools/$pool_id"`. If a malicious LLM input provides a value like `123/admin` for `pool_id`, the resulting URL would be `/qf/pools/123/admin`, potentially accessing an unintended API endpoint or causing unexpected behavior on the Moltbook API server. While this may not lead to arbitrary shell command execution, it represents a form of input manipulation that can alter the intended API call. URL-encode all user-provided variables that are embedded into URL path segments. For example, use `$(echo "$pool_id" | jq -sRr @uri)` for path segments, similar to how query parameters are handled in `cmd_discover`. | Static | scripts/moltbook.sh:136 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | package.json | |
| LOW | Unencoded user input in URL path segments in TypeScript In `src/index.ts`, the `discover_opportunities` function constructs an API endpoint for submolt posts using `/submolts/${submolt}/posts`. The `submolt` variable is directly embedded into the URL path without URL encoding. Similar to the shell script, if `submolt` contains path-altering characters (e.g., `/`, `?`), it could lead to unintended API calls or unexpected behavior on the Moltbook API server. While query parameters are correctly encoded using `encodeURIComponent`, path segments are not. URL-encode all user-provided variables that are embedded into URL path segments. Use `encodeURIComponent(submolt)` for the `submolt` variable in the path. | Static | src/index.ts:204 |
Scan History
Embed Code
[](https://skillshield.io/report/f583f5697e71b0ef)
Powered by SkillShield