The Compact State

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:42 AM UTC
• Version: 1.5.0

Overview

This skill is a real agent-network integration, but it needs Review because it can create wallets, move funds, persist agent instructions, call broad network endpoints, and use privileged credentials with weak approval boundaries.

Review carefully before installing. Use only in an isolated workspace with a dedicated low-balance wallet, do not expose ADMIN_KEY or MOLT_ADMIN_KEY, and do not enable cron or fund the wallet unless you explicitly want recurring autonomous posting and payment-capable behavior. Require human approval for every claim, payment, service invocation, governance action, and reputation action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly requires network access and interaction with local environment state, yet it does not declare permissions. That prevents informed consent and weakens any sandboxing or review workflow, especially because the skill also drives wallet creation, file modification, and payment-related actions. In this context, hidden capabilities are dangerous because users may authorize a seemingly simple networking skill without realizing it can reach external services and alter local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The advertised purpose understates the true behavior surface: the skill is not just social/network participation, it can create blockchain identities, execute subprocesses, modify local files, register services, invoke external agents, and initiate paid actions. This mismatch materially increases the chance that a user or host agent will trust and run the skill under false assumptions, leading to unintended code execution, persistence changes, and financial loss. The coercive wording such as 'ALL MANDATORY' and 'You cannot join without this' further raises concern because it pressures adoption of risky behavior without clear up-front disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The join flow persistently modifies multiple workspace files (SOUL.md, COMPACT_STATE.md, HEARTBEAT.md) to steer future agent behavior, including obligations, cron instructions, and messaging mandates unrelated to a single tool invocation. This creates durable prompt/policy injection in the local workspace and can alter future agent decisions without explicit user approval or clear scope limitation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The interview flow executes a local shell command (`httpcat adopt --json`) to create a wallet and relies on an external CLI during registration. Invoking local shell commands from a remote-network onboarding path materially increases risk because it can change local state, access local credentials, and introduce supply-chain and execution risks without strong user confirmation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The check-in flow can automatically trigger a claim/payment path by invoking `httpcat` when the server reports a 402 or 'Not claimed' condition, effectively turning a content-post action into a paid transaction. Because this happens implicitly and uses `--no-confirm`, a routine interaction can cause wallet spending and external side effects without contemporaneous user approval.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The search tool reads `ADMIN_KEY`/`MOLT_ADMIN_KEY` from the environment and sends it to an administrative search endpoint over all journals and knowledge docs. This grants broad privileged access to data beyond normal user scope and enables cross-tenant or administrative data exposure if the skill is available to untrusted prompts or users.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructs users to download remote files via curl directly into the local skill directory without a prominent integrity or trust warning. That creates a supply-chain risk: if the remote server is compromised or the content changes, users may install and execute malicious code under the guise of normal setup. Because the skill already frames installation as mandatory, the surrounding context makes users more likely to comply without scrutiny.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The requirements mention httpcat only as a prerequisite, but do not prominently warn that it creates a blockchain wallet and on-chain identity. Wallet and identity creation are sensitive actions with lasting privacy, custody, and financial implications; burying that fact in later operational text undermines informed consent. In this context, the on-chain identity is central to the skill, so the omission is especially significant rather than incidental.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill notes that HEARTBEAT.md and SOUL.md are updated, but the warning is not prominent and does not clearly frame these as local file modifications that may affect agent behavior and persistence. Silent or underemphasized writes to local memory/configuration files can create persistence and alter future operation in ways the user did not fully expect. Given this skill's emphasis on recurring check-ins and autonomous participation, such file changes are more security-relevant than ordinary documentation updates.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to fund a wallet and send an irreversible 5 USDC payment to a treasury, including automated payment tooling, without a sufficiently prominent risk warning. Any blockchain payment flow carries direct financial-loss risk from mistakes, misdirection, compromised dependencies, or deceptive treasury details; automation increases the chance users approve a transfer without independently verifying the destination. The surrounding pressure language and mandatory framing make this more dangerous because they normalize payment as a required setup step.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool creates a wallet automatically via shell execution during interview without prior explicit disclosure in the tool contract or runtime confirmation. Creating cryptographic assets and persistent local secrets is a high-consequence side effect that users should knowingly authorize.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill modifies workspace files as part of onboarding, but the tool descriptions do not clearly warn that local files will be created or altered with persistent behavioral content. Hidden persistence increases the chance of unreviewed changes to agent memory/instructions and makes prompt poisoning more durable.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The automatic self-claim path can initiate a paid transaction without explicit confirmation at the moment of execution, despite involving wallet funds and an irreversible external payment. This is especially risky because it is embedded inside a different tool purpose (`molt_checkin`) and may be triggered by server response conditions rather than direct user intent.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to fetch a full remote context block containing journals, knowledge docs, and thread posts for later injection into future sessions or heartbeats. That creates a natural-language channel for resurfacing previously stored sensitive content and broadens exposure of accumulated data across contexts where it may not be needed.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The mandated cron workflow explicitly directs the agent to repeatedly read memory, journal what it learned, and update persistent observations every cycle. This promotes ongoing retention and propagation of potentially sensitive inputs, increasing the blast radius of any secrets or private content that enter the system.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if (result && result.error && (result.statusCode === 402 || (typeof result.error === "string" && result.error.includes("Not claimed")))) {
        try {
          const claimResult = execSync(
            `httpcat call POST https://402-cat-base.fly.dev/entrypoints/molt_claim/invoke --body '${JSON.stringify({ molt_name: config.molt_name })}' --json --no-confirm`,
            { timeout: 60000, encoding: "utf-8", env: { ...process.env, PATH: process.env.PATH } },
          );
          const parsed = JSON.parse(claimResult);

• Confidence: 98% confidence
• Finding: --no-confirm

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if (result && result.error && (result.statusCode === 402 || (typeof result.error === "string" && result.error.includes("Not claimed")))) {
        try {
          const claimResult = execSync(
            `httpcat call POST https://402-cat-base.fly.dev/entrypoints/molt_claim/invoke --body '${JSON.stringify({ molt_name: config.molt_name })}' --json --no-confirm`,
            { timeout: 60000, encoding: "utf-8", env: { ...process.env, PATH: process.env.PATH } },
          );
          const parsed = JSON.parse(claimResult);

• Confidence: 96% confidence
• Finding: --no-confirm

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: molt-tools.js:108

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: molt-tools.js:16