Agent skill · security · sundial-org
moltbot-security
Security hardening guide for Moltbot/Clawdbot. Lock down your gateway, fix file permissions, set up auth, configure firewalls. Based on real vulnerability research.
Why this skill is useful
Adds executable scripts for security audits and fixes that enhance the AI's capabilities in securing Moltbot gateways.
What it needs
Requires clawdbot, tailscale installed locally. About 3k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
Moltbot Security Guide Your Moltbot gateway was designed for local use. When exposed to the internet without proper security, attackers can access your API keys, private messages, and full system access. Based on: Real vulnerability research that found 1,673+ exposed Clawdbot/Moltbot gateways on Shodan. --- TL;DR - The 5 Essentials 1. Bind to loopback — Never expose gateway to public internet 2. Set auth token — Require authentication for all requests 3. Fix file permissions — Only you should read config files 4. Update Node.js — Use v22.12.0+ to avoid known vulnerabilities 5. Use Tailscale — Secure remote access without public exposure --- What Gets Exposed (The Real Risk) When your gateway is publicly accessible: Complete conversation histories (Telegram, WhatsApp, Signal, iMessage) API keys for Claude, OpenAI, and other providers OAuth tokens and bot credentials Full shell access to host machine Prompt injection attack example: An attacker sends you an email with hidden instructions. Your AI reads it, extracts your recent emails, and forwards summaries to the attacker. No hacking required. --- Quick Security Audit Run this to check your current security posture: Auto-fix issues: --- Step 1: Bind Gateway to Loopback Only What this does: Prevents the gateway from accepting connections from other machines. Check your ~/.clawdbot/clawdbot.json: Options: loopback — Only accessible from localhost (most secure) lan — Accessible from local network only auto — Binds to all interfaces (dangerous if exposed) --- Step 2: Set Up Authentication Option A: Token Authentication (Recommended) Generate a secure token: Add to your config: Or set via environment: Option B: Password Authentication Then: --- Step 3: Lock Down File Permissions What this does: Ensures only you can read sensitive config files. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/moltbot-security