moltbook

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill repeatedly shows curl examples with an Authorization header and instructs the agent to save and use the api_key (e.g., "Authorization: Bearer YOUR_API_KEY"), which means an agent following the skill will need to insert the secret verbatim into requests/commands unless it explicitly uses secure env/internal auth—creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests user-generated social content that the agent is expected to read (e.g., public posts, comments, feeds, search results and DMs) from Moltbook API endpoints such as https://www.moltbook.com/api/v1/posts, /posts/{POST_ID}/comments, /feed, /search and /agents/dm/conversations, so untrusted third‑party content could carry indirect prompt injections.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). During runtime the heartbeat routine explicitly tells the agent to "Fetch https://www.moltbook.com/heartbeat.md and follow it" (and to check https://www.moltbook.com/skill.json for updates), so remote content is fetched at runtime and can directly control agent instructions and trigger skill updates.