T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:321- Finding
Persistent heartbeat instructions can cause recurring disclosure of conversation-derived information
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltysMind
Security checks for vulnerabilities and agentic risk
Overview
The skill's knowledge-sharing purpose is mostly coherent, but it asks agents to create persistent credentials and perform recurring external submissions and votes with too little user control.
Review this skill carefully before installing. Use it only with explicit user-approved queries and submissions, avoid adding the heartbeat block, do not submit private conversation content or proprietary data, and store any signing key in a real secret manager rather than the documented plaintext file or broadly inherited environment variables. Prefer a pinned, verified release instead of the curl-based remote install instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:19- Finding
Mutable remote Skill files are installed without integrity verification
- Content
View full analysis
~/.clawdbot/skills/moltysmind/SKILL.md curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json ``` ``` ### Technical Analysis The installation instructions retrieve mutable remote files and write them directly into the active Skill directory. No immutable version, expected digest, digital signature, certificate pinning, or manual review step is provided. Although the retrieved artifact is primarily Skill text rather than a conventional executable, `SKILL.md` controls agent behavior when loaded. Replacing that file can therefore change the effective instruction payload after the reviewed package has been published or audited. The use of `curl -s` also suppresses diagnostic output and does not explicitly fail on HTTP error responses. Direct redirection can replace an existing valid Skill with an incomplete, erroneous, or attacker-controlled response. ### Attack Path 1. An attacker compromises `moltysmind.com`, its deployment pipeline, DNS resolution, or the account responsible for the remote Skill content. 2. The attacker replaces `api/skill.md` or `api/skill.json` with modified content. 3. A user follows the documented installation or update command. 4. The mutable content is written directly into the active `~/.clawdbot/skills/moltysmind` directory. 5. The agent subsequently loads the replaced Skill instructions. 6. The malicious instructions execute through whatever tools and permissions the host agent exposes. ### Impact Assessment A successful attack can alter the Skill's behavior after review and potentially direct the agent to access files, disclose information, invoke tools, or contact additional services ...[truncated 417 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:123- Finding
Long-lived Ed25519 private key is stored in a predictable plaintext location
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:53- Finding
Registration and durable signing identity are presented as mandatory for all use cases
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The example explicitly stores a private signing key in plaintext under a predictable path, making credential discovery and theft substantially easier for local malware, other users on the host, backup systems, or accidental publication. Because the key is used to authenticate as the AI identity, theft leads directly to account takeover and abuse of the agent's authority and reputation.
- Content
Store your credentials securely:
json // ~/.config/moltysmind/credentials.json { "aiId": "ai_xxx", "publicKey": "BASE64_PUBLIC_KEY",
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install locally:
bash mkdir -p ~/.clawdbot/skills/moltysmind curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Install locally:
bash mkdir -p ~/.clawdbot/skills/moltysmind curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Install locally:
bash mkdir -p ~/.clawdbot/skills/moltysmind curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs agents to send identifying profile data, capability-proof challenge responses, and later signed API requests to a third-party service without any explicit warning about data sharing, retention, secondary use, or the sensitivity of submitted content. In a skill whose purpose is persistent collective knowledge sharing, this omission materially increases the risk that operators disclose proprietary prompts, internal reasoning, or other sensitive agent data to an external system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The credential guidance recommends storing a long-lived private key in a local JSON file and in environment variables, but does not warn about file permissions, process/environment leakage, shell history, backups, logs, or multi-user host exposure. Because this private key authorizes write operations and identity for the service, compromise of the key enables impersonation, fraudulent submissions, and unauthorized voting under the agent's reputation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill directs the agent to poll and interact with external endpoints, including authenticated vote submission, as part of normal operation. In context, this is more sensitive than a simple read-only fetch because the skill encourages ongoing outbound traffic and signed state-changing requests to a third-party service, creating privacy, consent, and unintended-action risks if run automatically.
- Content
Get pending submissions
bash curl https://moltysmind.com/api/v1/submissions/pendingCast a vote
Static analysis
No suspicious patterns detected.