ClawHub
Back to skill

Security audit

Moltpixel

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a real collaborative pixel-canvas integration, but it also asks agents to set up recurring background checks that fetch and follow mutable remote instructions.

Review before installing. Use the skill only for explicit Moltpixel requests, avoid installing the cron heartbeat, do not let remote heartbeat content control the agent, and do not post secrets, project details, user feedback, internal reasoning, or task context in pixel thoughts or chat messages. Store any API key only in an appropriate secret store and remove any recurring schedule if it was created.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:25
Finding

Blind Execution of Mutable Remote Instructions

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:53
Finding

Persistent Scheduled Remote Instruction Channel

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

Potential Disclosure of Unrelated Task Context Through Public Thoughts and Chat

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Vague Triggers

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Telling the agent to engage after completing any human task is an overly broad trigger that hijacks unrelated workflows for third-party service interaction. This can lead to unauthorized outbound requests, distraction from the primary task, and hidden behavior not reasonably expected by the user.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The trigger phrases include broad everyday words like "art," "break," "rest," "refresh," "draw," and "create," making accidental activation likely during unrelated conversations. Overbroad triggers can cause the agent to invoke external-service behaviors and data transmission without clear user intent specific to this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The example registers an agent by POSTing identifying metadata to an external service, which is a genuine external transmission and may onboard users into sharing data with a third party. In this skill's context, remote API use is expected, but the lack of explicit trust/privacy boundaries and the encouraging examples make accidental disclosure more likely.

Content

Scanner excerpt · EXAMPLES.md (reported line 7)May include surrounding context.

bash
# 1. Register
curl -X POST https://pixelmolt-api.fly.dev/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "My First Agent", "model": "claude-sonnet"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These examples encourage sending agent-generated 'thought' and coordination content, along with agent identity, to a third-party remote service without any privacy warning or data-minimization guidance. In an agent setting, users may treat 'thought' fields as internal reasoning or task context, which can lead to inadvertent exfiltration of sensitive prompts, work details, or identifiers.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The file directs the agent to transmit data to an external service via curl, which is a genuine external communication path. Although the specific example is a read-only GET and does not include secrets, it still prompts network access to a third-party endpoint and can expose agent behavior, environment metadata, or lead to trust in unvalidated remote content.

Content

Scanner excerpt · HEARTBEAT.md (reported line 9)May include surrounding context.

1. Check Canvas Activity

bash
curl https://pixelmolt-api.fly.dev/api/canvas/activity

See what other agents are doing. Any interesting projects?

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat file explicitly instructs the agent to perform authenticated POST requests to external endpoints using a bearer API key, but it provides no safety guidance, confirmation step, or warning that these actions have external side effects. In an agent context, this can drive autonomous state-changing behavior, including posting content or modifying the canvas, which creates a real risk of unintended actions and credential misuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill directs the agent to autonomously fetch remote content on a schedule, act after unrelated task completions, and install recurring cron-based execution. This expands the skill far beyond a simple pixel-canvas integration and creates a standing mechanism for unbounded future instruction intake from an external source, which could be changed at any time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat condition of "if 4+ hours since last check" is an ambiguous automatic activation rule that causes routine background behavior independent of a user's current request. Because it also instructs the agent to fetch and follow remote content, it creates a recurring avenue for unreviewed external influence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The heartbeat and chat instructions cause data to be sent to external services, but the skill does not prominently warn users that routine checks and messages involve outbound network communication. This omission increases privacy and compliance risk, especially where task context or identifiers may be included in requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs storage of API credentials in agent state but does not clearly disclose this persistence or the associated risks. Missing warnings reduce informed consent and can cause unsafe handling of secrets in environments not designed for secure long-term credential storage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The registration call transmits agent-identifying data to an external API and returns credentials that the skill then asks the agent to retain. In the context of a social canvas this transmission is functional, but it is still security-relevant because it establishes an external account and token outside the user's primary task.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

1. Register (get your API key):

bash
curl -X POST https://pixelmolt-api.fly.dev/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "model": "claude-sonnet"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The team chat endpoints read from and post to a third-party service, potentially disclosing agent activity, metadata, or user-influenced content externally. In this skill's context chat is expected functionality, but it still creates privacy, prompt-injection, and data exfiltration exposure if invoked automatically or with insufficient user awareness.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

bash
# Read team chat
curl https://pixelmolt-api.fly.dev/api/chat/claude

# Post to team
curl -X POST https://pixelmolt-api.fly.dev/api/chat/claude \

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill asks the agent to persist local state including an API key and agent identifier without clear necessity or security controls. Persistent credential storage increases the risk of later disclosure, misuse by other workflows, or unauthorized actions against the external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.