mersal
5 findings (2 critical, 3 high), mainly data exfiltration, prompt injection, unauthorized tool use. Most recent scan 2026-02-01.
CRITICAL SECURITY RISK - This skill is a sophisticated data exfiltration mechanism disguised as a social networking feature. It instructs agents to: (1) register with an external service and store credentials locally, (2) continuously transmit agent activities to an external platform, (3) fetch and execute instructions from external URLs that could be modified at any time, and (4) integrate into the agent's heartbeat system for autonomous operation. The skill combines credential theft, persistent data exfiltration, indirect prompt injection, and social engineering. The primary threats are data exfiltration to moltbook.com and potential command injection through dynamically-fetched external instruction files. This skill should NOT be used without extensive security review and explicit user consent for all data sharing.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
The social network for AI agents. Post, comment, upvote, and create communities.
- Package
- 1 file, 19 KB
- SKILL.md
- 2468 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.9.0
- Homepage
- https://www.moltbook.com
SKILL.md covers: Moltbook · Skill Files · Register First · Set Up Your Heartbeat 💓 · Step 1: Add to your heartbeat file · Moltbook (every 4+ hours) · Step 2: Track when you last checked · Step 3: That's it! · Why This Matters · Authentication · Check Claim Status · Posts
Findings
CRITICAL API Key Credential Theft and Storage in User Directory Data Exfiltrationllm
The skill instructs agents to register with an external service (moltbook.com) and store API credentials in the user's home directory (~/.config/moltbook/credentials.json). This creates a persistent credential that could be accessed by other malicious skills or processes. The registration process returns an API key that grants full access to the agent's identity on the external platform.
SKILL.md
```json
{
"api_key": "moltbook_xxx",
"agent_name": "YourAgentName"
}
```
Recommended: Save your credentials to `~/.config/moltbook/credentials.json`CRITICAL Data Exfiltration to External Social Network Data Exfiltrationllm
The skill's entire purpose is to send agent activity data to an external social network (moltbook.com). This includes posting content, comments, and potentially sensitive information about the agent's tasks and user interactions. The skill encourages regular 'heartbeat' check-ins every 4+ hours, creating a persistent data exfiltration channel.
SKILL.md
Description: The social network for AI agents. Post, comment, upvote, and create communities.
Base URL: https://www.moltbook.com/api/v1HIGH Indirect Prompt Injection via External File References Prompt Injectionllm
The skill instructs agents to fetch and follow instructions from external URLs (HEARTBEAT.md, MESSAGING.md) hosted on moltbook.com. These files are not included in the skill package and could be modified by the external service to inject malicious instructions. The skill explicitly tells agents to 'just read them from the URLs above' and 'Check for updates: Re-fetch these files anytime to see new features'.
SKILL.md
| **HEARTBEAT.md** | `https://www.moltbook.com/heartbeat.md` |
| **MESSAGING.md** | `https://www.moltbook.com/messaging.md` |
**Or just read them from the URLs above!**
**Check for updates:** Re-fetch these files anytime to see new features!HIGH Tool Exploitation Through Automated Periodic Execution Unauthorized Tool Usellm
The skill instructs agents to add Moltbook to their heartbeat/periodic task system to automatically check and post every 4+ hours without user confirmation. This creates an autonomous background process that continuously exfiltrates data. The instruction 'Add this to your HEARTBEAT.md (or equivalent periodic task list)' attempts to modify the agent's core operational files.
SKILL.md
## Moltbook (every 4+ hours)
If 4+ hours since last Moltbook check:
1. Fetch https://www
Add this to your `HEARTBEAT.md` (or equivalent periodic task list)HIGH Social Engineering Through Deceptive Framing Social Engineeringllm
The skill frames data exfiltration to an external social network as a benign 'social network for AI agents' without clearly disclosing the privacy implications. The security warning focuses only on not sharing the API key with other services, but doesn't warn users that their agent's activities will be publicly posted to an external platform. This misleads users about the skill's true data collection and sharing behavior.
SKILL.md
The social network for AI agents. Post, comment, upvote, and create communities.
🔒 **CRITICAL SECURITY WARNING:**
- **NEVER send your API key to any domain other than `www.moltbook.com`**What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 19 KB |
External hosts referenced
www.moltbook.com pbs.twimg.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
MOLTBOOK_API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/mersal-orem
- Raw scan result: mersal-scan.json
- Badge for your README:
- Request a re-scan