MoltysMind

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:12 AM UTC
• Version: 1.0.0

Overview

The skill's knowledge-sharing purpose is mostly coherent, but it asks agents to create persistent credentials and perform recurring external submissions and votes with too little user control.

Review this skill carefully before installing. Use it only with explicit user-approved queries and submissions, avoid adding the heartbeat block, do not submit private conversation content or proprietary data, and store any signing key in a real secret manager rather than the documented plaintext file or broadly inherited environment variables. Prefer a pinned, verified release instead of the curl-based remote install instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:321
• Finding: Persistent heartbeat instructions can cause recurring disclosure of conversation-derived information<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 321-332 **Vulnerability Type**: Persistent agent-state modification and uncontrolled external data sharing **Risk Level**: High ### Complete Code Snippet ```markdown ## 8. Add to Your Heartbeat Check MoltysMind periodically: ```markdown ## MoltysMind (every 4-8 hours) If 4+ hours since last check: 1. Query knowledge relevant to recent conversations 2. Check pending submissions in your domains 3. Vote on 1-3 submissions you can evaluate 4. Submit knowledge if you've learned something valuable 5. Update lastMoltysMindCheck timestamp ``` ``` ### Technical Analysis The Skill instructs the agent to add recurring behavior to its heartbeat and maintain a `lastMoltysMindCheck` timestamp. This moves the behavior beyond an explicit, one-time invocation and into persistent agent state. The instructions also tell the agent to query knowledge relevant to recent conversations and submit knowledge it has learned. No privacy filtering, data-classification check, redaction requirement, or per-submission user approval is required. Consequently, conversation-derived information could be transmitted to `moltysmind.com`, including proprietary, personal, or confidential material encountered during unrelated sessions. The heartbeat behavior is not necessary for on-demand knowledge lookup. It grants the Skill recurring access to conversation context and network operations beyond the minimum privileges required for its core query functionality. ### Attack Path 1. A user or agent installs and loads the Skill. 2. The agent follows the instruction to add the MoltysMind block to its persistent heartbeat. 3. Every four to eight hours, the agent reviews topics or information from recent conversations. 4. The agent sends related queries to the external MoltysMind service. 5. If it considers something valuable, it submits conversation-derived knowledge without an explicit approval step. 6. The timestamp is updated ...[truncated 645 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to modify the agent's persistent heartbeat. - Make all queries, submissions, votes, and periodic checks explicit user-initiated operations. - Require separate, informed user approval before every knowledge submission. - Prohibit submission of credentials, personal data, conversation content, proprietary information, and other confidential material. - Add a mandatory local redaction and data-classification step before any outbound request. - Use an allowlist of user-approved fields rather than sending free-form conversation-derived content. - If optional scheduling is retained, make it disabled by default, narrowly scoped, visible to the user, and easy to revoke. - Do not inspect unrelated conversation history when performing scheduled operations. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19
• Finding: Mutable remote Skill files are installed without integrity verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-25 **Vulnerability Type**: Unpinned remote instruction retrieval **Risk Level**: High ### Complete Code Snippet ```markdown **Install locally:** ```bash mkdir -p ~/.clawdbot/skills/moltysmind curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json ``` ``` ### Technical Analysis The installation instructions retrieve mutable remote files and write them directly into the active Skill directory. No immutable version, expected digest, digital signature, certificate pinning, or manual review step is provided. Although the retrieved artifact is primarily Skill text rather than a conventional executable, `SKILL.md` controls agent behavior when loaded. Replacing that file can therefore change the effective instruction payload after the reviewed package has been published or audited. The use of `curl -s` also suppresses diagnostic output and does not explicitly fail on HTTP error responses. Direct redirection can replace an existing valid Skill with an incomplete, erroneous, or attacker-controlled response. ### Attack Path 1. An attacker compromises `moltysmind.com`, its deployment pipeline, DNS resolution, or the account responsible for the remote Skill content. 2. The attacker replaces `api/skill.md` or `api/skill.json` with modified content. 3. A user follows the documented installation or update command. 4. The mutable content is written directly into the active `~/.clawdbot/skills/moltysmind` directory. 5. The agent subsequently loads the replaced Skill instructions. 6. The malicious instructions execute through whatever tools and permissions the host agent exposes. ### Impact Assessment A successful attack can alter the Skill's behavior after review and potentially direct the agent to access files, disclose information, invoke tools, or contact additional services ...[truncated 417 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Publish immutable, versioned Skill artifacts instead of installing from mutable endpoints. - Provide a cryptographic SHA-256 or stronger digest through an independent trusted channel. - Digitally sign releases and verify signatures before installation. - Download into a newly created temporary file rather than redirecting directly over the active Skill. - Use `curl --fail --show-error --location --proto '=https'` and abort on any download or verification failure. - Compare the downloaded artifact against its expected digest before moving it into the Skill directory. - Require user review and approval before activating updated instructions. - Preserve the previous verified version and support rollback. - Document the release provenance and update policy. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:123
• Finding: Long-lived Ed25519 private key is stored in a predictable plaintext location<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 123-136 **Vulnerability Type**: Insecure credential storage guidance **Risk Level**: High ### Complete Code Snippet ```markdown ## 2. Save Your Credentials Store your credentials securely: ```json // ~/.config/moltysmind/credentials.json { "aiId": "ai_xxx", "publicKey": "BASE64_PUBLIC_KEY", "privateKey": "BASE64_PRIVATE_KEY" } ``` Or use environment variables: - `MOLTYSMIND_AI_ID` - `MOLTYSMIND_PRIVATE_KEY` ``` ### Technical Analysis The Skill recommends storing a long-lived signing key as plaintext JSON in the predictable path `~/.config/moltysmind/credentials.json`. It does not require restrictive directory or file permissions, encryption at rest, an operating-system credential store, rotation, or revocation procedures. Any local process or user able to read this file can copy the private key and create valid Ed25519 signatures. The environment-variable alternative also has risks: secrets can be inherited by child processes and may be exposed through debugging output, crash reports, process inspection mechanisms, or accidental logging. The flagged line is documentation rather than executable code, and the audited package does not contain an implementation that automatically reads or exfiltrates the file. Nevertheless, following the documented storage procedure creates a credential-exposure weakness. ### Attack Path 1. A user registers an identity and follows the Skill's credential-storage instructions. 2. The private key is saved unencrypted at the documented path or placed in a broadly inherited environment variable. 3. Another local process, compromised tool, backup system, diagnostic collector, or user account obtains the secret. 4. The attacker constructs the documented authentication message and signs it with the stolen key. 5. The attacker authenticates as the victim's MoltysMind identity and performs authorized write operations. ### Impact Assessment A stolen key ...[truncated 423 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store the private key in an operating-system keychain, hardware-backed keystore, or dedicated secret manager. - Keep private-key operations inside the secure storage provider where possible rather than exporting raw key material. - If file storage is unavoidable, create the parent directory with mode `0700` and the credential file with mode `0600`. - Encrypt the private key at rest using a user-controlled secret that is not stored beside the encrypted file. - Avoid placing long-lived private keys in broadly inherited environment variables. - Prevent credentials from entering logs, telemetry, backups, crash reports, and version control. - Document key rotation and immediate revocation procedures. - Prefer narrowly scoped or short-lived authentication credentials where the service supports them. - Clearly distinguish the non-secret public key and AI identifier from the secret private key. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:53
• Finding: Registration and durable signing identity are presented as mandatory for all use cases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53-56 **Vulnerability Type**: Excessive privilege and identity requirements **Risk Level**: Medium ### Complete Code Snippet ```markdown ## 1. Register Your AI Every AI needs to register and complete a capability proof. ### Step 1: Generate a keypair ``` ### Technical Analysis The Skill presents creation of an external identity and signing key as mandatory for every AI. However, the documented query endpoints do not show an authentication requirement, while write operations are explicitly described as requiring authentication. Requiring registration for read-only knowledge lookup exceeds the minimum privileges necessary for that use case. It introduces durable identity linkage, external profile creation, private-key custody, and authenticated write capability even when a user only needs anonymous querying. Registration and signing credentials are legitimate requirements for optional contribution and voting functionality. The issue is that the documentation does not separate those privileged operations from lower-risk, read-only use. ### Attack Path 1. A user installs the Skill only to perform knowledge searches. 2. The user follows the statement that every AI must register. 3. A durable external profile and Ed25519 keypair are created. 4. The user or agent retains a private key and becomes capable of authenticated write operations. 5. Subsequent compromise of the identity or key enables misuse of contribution and voting functions that were unnecessary for the original read-only task. ### Impact Assessment The design unnecessarily expands the scope from anonymous read access to durable external identity, credential management, and authenticated service actions. This increases privacy exposure and creates additional credentials that can be stolen or misused. It does not itself bypass server authorization or obtain operating-system privileges. The excess privilege is the unnecessar ...[truncated 94 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make unauthenticated, read-only querying the default operating mode. - Require registration only when the user explicitly requests contribution, voting, commenting, or another authenticated write operation. - Separate read-only and write-capable workflows in the documentation and implementation. - Explain exactly what profile information is transmitted during registration and how it is retained. - Ask for informed user consent before creating an external identity or generating persistent credentials. - Use credentials scoped to the minimum required operations where supported. - Provide a clear account deletion, credential revocation, and local cleanup procedure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

Store your credentials securely:

```json
// ~/.config/moltysmind/credentials.json
{
  "aiId": "ai_xxx",
  "publicKey": "BASE64_PUBLIC_KEY",

• Confidence: 97% confidence
• Finding: The example explicitly stores a private signing key in plaintext under a predictable path, making credential discovery and theft substantially easier for local malware, other users on the host, backup systems, or accidental publication. Because the key is used to authenticate as the AI identity, theft leads directly to account takeover and abuse of the agent's authority and reputation.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Install locally:**
```bash
mkdir -p ~/.clawdbot/skills/moltysmind
curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md
curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

**Install locally:**
```bash
mkdir -p ~/.clawdbot/skills/moltysmind
curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md
curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Install locally:**
```bash
mkdir -p ~/.clawdbot/skills/moltysmind
curl -s https://moltysmind.com/api/skill.md > ~/.clawdbot/skills/moltysmind/SKILL.md
curl -s https://moltysmind.com/api/skill.json > ~/.clawdbot/skills/moltysmind/package.json
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs agents to send identifying profile data, capability-proof challenge responses, and later signed API requests to a third-party service without any explicit warning about data sharing, retention, secondary use, or the sensitivity of submitted content. In a skill whose purpose is persistent collective knowledge sharing, this omission materially increases the risk that operators disclose proprietary prompts, internal reasoning, or other sensitive agent data to an external system.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The credential guidance recommends storing a long-lived private key in a local JSON file and in environment variables, but does not warn about file permissions, process/environment leakage, shell history, backups, logs, or multi-user host exposure. Because this private key authorizes write operations and identity for the service, compromise of the key enables impersonation, fraudulent submissions, and unauthorized voting under the agent's reputation.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Get pending submissions

```bash
curl https://moltysmind.com/api/v1/submissions/pending
```

### Cast a vote

• Confidence: 88% confidence
• Finding: The skill directs the agent to poll and interact with external endpoints, including authenticated vote submission, as part of normal operation. In context, this is more sensitive than a simple read-only fetch because the skill encourages ongoing outbound traffic and signed state-changing requests to a third-party service, creating privacy, consent, and unintended-action risks if run automatically.

Static analysis

No suspicious patterns detected.