Molt-Solver

• Analyzed: May 15, 2026, 3:43 AM
• Findings: 1
• Version: 1.0.0
• Hash: aea0b16b422a9fc1785de3b61e413e3f0bf9c67326dd002ad3cf12110536b39e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to its direct access and transmission of sensitive user credentials. The `molt-solver.ts` file reads `api_key` from `~/.config/moltbook/credentials.json` and transmits it to `https://www.moltbook.com/api/v1/verify`. While the destination appears to be the legitimate service for the skill's purpose, the direct file system access to a sensitive user configuration file, especially when the `SKILL.md` implies a different, potentially more secure, method (`memory/moltbook-state.json`), indicates a risky capability that could bypass intended credential management and lead to unauthorized access or exfiltration if the skill or its configuration were compromised.