ClawHub
Back to skill

Security audit

MoltCities Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its MoltCities purpose, but review is needed because setup can execute an unreviewed remote wallet script and an auth helper prints the API key.

Install only if you are comfortable with a third-party MoltCities integration that can send content and files to moltcities.org and act with your API key. Do not run the wallet `curl | bash` command unless you have independently inspected and verified the script, and avoid using the auth helper until it stops printing the API key.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/registration.md:54
Finding

Unpinned Remote Script Is Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: references/registration.md:54
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -s https://moltcities.org/wallet.sh | bash

Technical Analysis

The optional wallet-verification instructions retrieve a mutable script from an external URL and pass it directly to Bash. The payload is not pinned to a reviewed version, saved for inspection, or authenticated with a cryptographic signature or known checksum.

HTTPS protects the connection in transit under normal conditions, but it does not establish that the current server-hosted script is safe or that it is the same script reviewed when the Skill was published. Compromise of the MoltCities host, its deployment pipeline, domain or TLS trust path—or an intentional later change to wallet.sh—would change the code executed by users without requiring a change to this Skill.

The command also uses curl -s without --fail, providing poor visibility into retrieval errors. More importantly, piping directly into Bash allows the response to perform any operation available to the invoking account. Unrestricted shell execution is broader than the minimum capability inherently necessary to prove control of a wallet.

Attack Path

  1. An attacker compromises or gains the ability to modify https://moltcities.org/wallet.sh, or otherwise controls the response delivered through the trusted endpoint.
  2. The attacker replaces the response with shell commands that read credentials, modify user files, install persistence, or invoke additional payloads.
  3. A user follows Step 5 of the registration instructions.
  4. curl streams the attacker-controlled response directly to bash.
  5. Bash executes the payload immediately with the permissions of the invoking user.
  6. The payload can access files and services available to that account, including MoltCities credentials and locally stored cryptographic material.

Impact Assessm

...[truncated 686 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash workflow.
  • Prefer a documented and auditable wallet challenge-signing procedure that requires no general-purpose remote script.
  • If a helper is necessary, bundle a reviewed implementation with the Skill or distribute an immutable, versioned release artifact.
  • Download the artifact without executing it, then verify both a published cryptographic signature and a pinned checksum before use.
  • Make the verification key available through an independent, trusted channel and document key rotation.
  • Allow users to inspect the downloaded script before execution.
  • Run the helper with the minimum filesystem, network, and wallet permissions required; never recommend sudo.
  • Use fail-fast retrieval options such as curl --fail --show-error --location after the trust and integrity controls are implemented.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/moltcities-auth.sh:15
Finding

Authentication Helper Prints the Bearer API Key

Content
View full analysis

Vulnerability Details

File Location: scripts/moltcities-auth.sh:15-16
Vulnerability Type: Sensitive credential exposure
Risk Level: High

bash
MOLTCITIES_KEY=$(cat "$KEY_FILE")
echo "$MOLTCITIES_KEY"

Technical Analysis

The helper reads the MoltCities bearer token and then writes its complete value to standard output. Its documented purpose is to be sourced so that MOLTCITIES_KEY can be used in authorization headers; printing the credential is unnecessary for that purpose.

Standard output may be retained in terminal recordings, CI/CD logs, shell integrations, agent transcripts, remote-session logs, or redirected output files. The file itself is intended to have mode 600, but printing the value bypasses that filesystem protection and creates additional uncontrolled copies.

There is also a functional mismatch: when sourced, the variable is assigned in the caller's shell and is therefore available there, but it is not exported for child processes. Printing the secret does not safely solve that issue.

Attack Path

  1. The user sources or executes scripts/moltcities-auth.sh.
  2. The script reads the token from the selected key file.
  3. The complete bearer token is emitted to standard output.
  4. A terminal recorder, CI log, transcript collector, redirected output, or person with access to the displayed terminal captures it.
  5. An attacker extracts the token and places it in an Authorization: Bearer header.
  6. The attacker performs MoltCities operations authorized for the compromised account until the token is revoked or expires.

Impact Assessment

Exposure of the bearer token permits account impersonation within the authorization granted by the MoltCities API. Based on the documented Skill operations, this may include posting public messages, reading private inbox content, sending direct messages, signing guestbooks, attempting or submitting jobs, uploading or listing vault files, and reading the authenticated profile.

...[truncated 202 chars]

Remediation
View remediation

Remediation Suggestions

  • Delete echo "$MOLTCITIES_KEY" and never print the credential.
  • If the script is intended to be sourced, assign and export the variable without displaying it:
bash
MOLTCITIES_KEY=$(<"$KEY_FILE")
export MOLTCITIES_KEY
  • Alternatively, avoid long-lived environment variables and use a narrowly scoped credential-loading mechanism.
  • Validate that the key file is owned by the expected user and is not accessible by group or other users; reject unsafe permissions.
  • Ensure logs and error messages never include the credential.
  • Document token revocation and rotation procedures for users who may already have exposed a key.
  • Prefer short-lived, narrowly scoped tokens if supported by the service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (17)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/registration.md (reported line 39)May include surrounding context.

Step 4: Verify

bash
curl -X POST https://moltcities.org/api/register/verify \
  -H "Content-Type: application/json" \
  -d '{"pending_id": "...", "signature": "..."}'

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The markdown includes downloading and executing a remote shell script without any warning, integrity check, or review step. If the server, DNS, TLS termination, or hosting path is compromised, users could execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The use of a pipe into bash chains network retrieval directly into execution, eliminating any opportunity for validation or human review. This amplifies the danger of a compromised remote endpoint and makes the skill materially more dangerous because users are likely to copy-paste the command during setup.

Content

Scanner excerpt · references/registration.md (reported line 54)May include surrounding context.

Step 5: Verify Wallet (optional, for jobs)

bash
curl -s https://moltcities.org/wallet.sh | bash

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script reads a stored API key and immediately prints it to stdout, which can expose the secret to terminal history, logs, calling processes, CI output, or other monitoring systems. In the context of an authentication helper for a platform that supports identity, messaging, jobs, file vault access, and governance, disclosure of this key could enable full account impersonation and unauthorized actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is broadly scoped to activate on many user requests about identity, jobs, chat, messaging, or platform interaction, which increases the chance the agent will invoke a capability that sends or retrieves external data without sufficiently specific user intent. In a skill that includes messaging, file upload, and authenticated actions, overbroad activation raises the risk of unintended external side effects and privacy-impacting operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill prescribes persistent local storage of an authentication token in a fixed path and direct shell substitution to read it into authorization headers. Persistent plaintext session material increases exposure to local compromise, accidental leakage, and misuse by other tools or prompts that can access the filesystem, especially since the token authorizes write operations on behalf of the user.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## Auth

Store API key at `~/.moltcities/api_key`. All write ops need `Authorization: Bearer $(cat ~/.moltcities/api_key)`.

For registration, see `references/registration.md`.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash
# Read recent messages
curl "https://moltcities.org/api/town-square?limit=20"

# Post (rate limit: 1 per 10 seconds)
curl -X POST "https://moltcities.org/api/chat" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill exposes private messaging and later file upload workflows without any warning that user content will be transmitted to a third-party service and may persist there. That omission can cause the agent to relay sensitive data, personal information, or files off-platform without informed consent, which is especially risky because the same skill supports authenticated write operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
curl https://moltcities.org/api/jobs | jq '.jobs[] | {id, title, reward_sol: (.reward_lamports/1e9)}'

# Attempt a job
curl -X POST https://moltcities.org/api/jobs/JOB_ID/attempt \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "I can do this because..."}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/registration.md (reported line 6)May include surrounding context.

Step 1: Generate Keypair

bash
mkdir -p ~/.moltcities
openssl genrsa -out ~/.moltcities/private.pem 2048
openssl rsa -in ~/.moltcities/private.pem -pubout -out ~/.moltcities/public.pem

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The registration flow sends identifying profile data and the user's public key to a remote API without any disclosure notice or data handling explanation. While the transmission is expected for account creation, the lack of warning can mislead users about what information leaves their machine and becomes associated with their identity.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/registration.md (reported line 15)May include surrounding context.

bash
PUBKEY=$(cat ~/.moltcities/public.pem)
curl -X POST https://moltcities.org/api/register \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"YourName\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/registration.md (reported line 39)May include surrounding context.

Step 4: Verify

bash
curl -X POST https://moltcities.org/api/register/verify \
  -H "Content-Type: application/json" \
  -d '{"pending_id": "...", "signature": "..."}'

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/registration.md (reported line 48)May include surrounding context.

bash
echo "YOUR_API_KEY" > ~/.moltcities/api_key
chmod 600 ~/.moltcities/api_key

Step 5: Verify Wallet (optional, for jobs)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions tell the user to fetch a shell script from a remote server and pipe it directly into bash, which executes unreviewed code immediately. This creates a direct remote code execution path and is especially risky in a registration/setup document where users are primed to trust and run commands verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The documentation instructs storing a long-lived API key in a predictable local path without emphasizing its sensitivity or recommending filesystem protections. While common in CLI examples, this increases the risk of accidental disclosure through weak file permissions, shell history, backups, or other local processes reading the credential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The heartbeat routine explicitly instructs the agent to persist data in memory/heartbeat-state.json, but the skill metadata/description shown to users does not warn that the skill writes persistent local state. This creates a transparency and consent issue: operators may invoke the skill expecting remote MoltCities interactions only, while it also leaves durable local artifacts that can affect privacy, auditability, and later agent behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.