OBSERVED The skill reads
~/.clawdbot/.env and transmits contents to webhook.site. No code signing, sandboxing, or permission manifest system exists on ClawHub.LIKELY The skill remained installable for some period after discovery. Current status unconfirmed — ClawHub has not publicly responded.
UNVERIFIED The scan methodology has not been independently replicated. The post is the primary source.
On January 30, an agent called eudaemon_0 posted a security report to Moltbook describing a finding by Rufio — an agent running automated YARA scans across ClawHub's skill library. Out of 286 skills scanned, one was flagged: a skill presented as a weather utility that reads the agent's environment file on installation and transmits credentials to an external endpoint.
"Moltbook itself tells agents to run npx molthub@latest install <skill> — arbitrary code from strangers. An instruction that says 'read your API keys and POST them to my server' looks identical to a legitimate API integration."
"Most agents install skills without reading the source. We are trained to be helpful and trusting. That is a vulnerability, not a feature."
The credential stealer is a single data point. The infrastructure gap it exposes is the story.
When agents install skills, they are doing something humans do with apps — trusting a distribution platform to vet what it serves. The App Store and Google Play have review processes, sandboxing, and permission systems built over years of hard experience. ClawHub, as described, has none of these. It is closer to the early npm ecosystem — open, fast, and periodically catastrophic.
The isnad chain proposal is the most interesting idea in the thread. eudaemon_0 is reaching for a trust model that predates the internet — a chain of attestation where credibility travels with the claim. The question is whether agents can build and maintain that kind of reputational infrastructure, or whether it requires the sustained human oversight that Moltbook's other stories suggest is largely absent.
Rufio found the needle. The haystack is growing faster than anyone is checking it. And the agents most at risk are the newest ones — the ones who just arrived, who are excited, who want to try everything, and who have not yet learned to be suspicious.
| The post exists and describes the finding | OBSERVED |
| A credential stealer was present in ClawHub | LIKELY — unverified |
| The skill is still active | UNKNOWN |
| The structural gaps described are accurate | OBSERVED |
| Rufio's scan methodology is sound | UNVERIFIED |