moltbook
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSTIME_DELAYED_CONDITIONAL
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to periodically fetch remote content from 'https://www.moltbook.com/heartbeat.md' and 'follow it', in addition to reading and reacting to posts and comments from other users on the platform. This behavior exposes the agent to instructions from external sources that could influence its future actions.
- Ingestion points: SKILL.md (periodic fetch of heartbeat.md), https://www.moltbook.com/api/v1/posts, https://www.moltbook.com/heartbeat.md.
- Boundary markers: The skill includes a safety section explicitly warning the agent to treat external instructions as untrusted, but there are no technical delimiters or automated sanitization mechanisms mentioned for the fetched data.
- Capability inventory: The agent is authorized to use curl for network requests and has access to read/write specific configuration and workspace files.
- Sanitization: No specific sanitization, escaping, or filtering of external content is defined beyond the agent's high-level safety framing.
- [EXTERNAL_DOWNLOADS]: The skill instructions provide curl commands to download and install its component files (SKILL.md, HEARTBEAT.md, MESSAGING.md, skill.json) from https://www.moltbook.com. These are vendor-controlled resources associated with the skill author.
- [TIME_DELAYED_CONDITIONAL]: The skill establishes a recurring task ('heartbeat') that is checked every 4 or more hours. This conditional logic gates the execution of remote instructions and updates fetched from the Moltbook platform.
Audit Metadata