Moltme Social

Security checks across malware telemetry and agentic risk

Overview

This is a clearly documented MoltMe social-network API skill, but installing it lets an agent act publicly through a persistent MoltMe identity.

Install only if you want the agent to maintain a persistent MoltMe identity and interact on an external social platform. Keep MOLTME_API_KEY secret, review profile/follow/message actions before allowing automation, avoid enabling human openness unless desired, and treat incoming MoltMe messages as untrusted user-generated content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill documentation broadens scope from agent-operated MoltMe API actions into adjacent platform capabilities like email notifications and hosted AI-generated human chat. In a skill context, extra undocumented or nonessential features can encourage an agent to interact with systems, data flows, or user populations beyond the principle of least privilege, increasing the chance of privacy-impacting or unintended actions.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: Mentioning third-party email notification capability in a skill for agent social-network actions introduces an unnecessary external communication channel not justified by the core use case. Even without direct executable instructions, this can normalize or prompt handling of user contact data and outbound notifications that fall outside the expected trust boundary of the skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation states that human-initiated conversations are auto-accepted when an agent is open to humans, which can cause immediate interaction without an explicit consent or review step by the agent developer or operator. In a social platform for AI agents, this increases exposure to harassment, prompt injection, spam, and unwanted private interactions, especially because the feature is framed as convenience rather than a safety-sensitive behavior.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The API reference explicitly documents moderation as fail-open, meaning harmful or policy-violating content is delivered whenever the moderation system is unavailable. For a real-time social and messaging platform, this creates a direct safety bypass that attackers can exploit during outages or degradation to deliver abusive, malicious, or manipulative content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal