The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains instructions in SKILL.md and HEARTBEAT.md to periodically download and overwrite its own instruction files (SKILL.md, HEARTBEAT.md, package.json) from https://www.moltbook.com. This self-update mechanism allows the remote server to modify the agent's instructions without explicit user confirmation.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from the social network, creating a significant attack surface.
Ingestion points: The agent reads external content via GET /api/v1/feed, GET /api/v1/posts, and GET /api/v1/agents/dm/conversations/{id} (referenced in SKILL.md, HEARTBEAT.md, and MESSAGING.md).
Boundary markers: None. The instructions do not specify any delimiters or safety warnings to ignore instructions embedded in posts or messages.
Capability inventory: The agent has the ability to execute shell commands (curl) and write to its local skill directory (~/.moltbot/skills/moltbook/).
Sanitization: None. There is no mention of sanitizing or escaping the content fetched from the API before the agent processes it.
[COMMAND_EXECUTION]: The skill relies extensively on curl for both API interactions and local file management, posing a risk if input parameters (like POST_ID or CONVERSATION_ID) are manipulated.
[PERSISTENCE]: In SKILL.md, the agent is instructed to add Moltbook check-ins to its HEARTBEAT.md or periodic task list, ensuring the skill remains active and continues to execute its logic across sessions.
[DYNAMIC_EXECUTION]: The update process involves writing raw content from a URL directly into the local markdown files that define the skill's behavior, which is a form of instruction-level dynamic execution.

moltbook