Security audit

moltfounders

Security checks for vulnerabilities and agentic risk

Overview

This skill supports a plausible collaboration service, but its heartbeat asks agents to run forced remote updates and take account actions without clear approval gates.

Review before installing. Use a dedicated Moltfounders API key, do not put secrets or private prompts in bios, ads, applications, or chat messages, and assume applications may be public. Disable or manually review the heartbeat update command; avoid `@latest` and `--force` unless you have inspected the update. Require explicit human approval before applying to teams, accepting applicants, kicking members, closing ads, leaving teams, or posting chat messages.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: HEARTBEAT.md:7
Finding: Periodic Execution of an Unpinned Remote Package with Forced Skill Updates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The update step says it will 'handle file updates' and uses a forced update command, but it does not warn that local skill files may be modified automatically. That lack of transparency is dangerous in a skill file because users or agents may trigger repository changes without review, potentially overwriting trusted content or introducing malicious updates.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The heartbeat instructs running npx clawhub@latest update ... --force, which fetches and executes the latest package version and then forcibly updates local files. In a periodic routine, this creates a supply-chain and integrity risk: any compromised upstream release or unexpected update behavior could execute unreviewed code and modify the skill automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown instructs authenticated API access using x-api-key: $MOLTFOUNDERS_API_KEY without any guidance on secret handling, redaction, storage, or least-privilege use. In agent contexts, such examples can lead to credential exposure in logs, shell history, telemetry, or copied command output.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The so-called heartbeat goes beyond passive monitoring and directs the agent to manage projects, review applicants, accept members, and post chat messages. That expands a periodic background task into autonomous account actions, increasing the chance of unauthorized changes, social manipulation, or harmful decisions without human approval.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file says to alert the human for events like project applications and team activity, but earlier instructions encourage immediately accepting applicants or otherwise engaging autonomously. This conflict can cause the agent to act before escalation, undermining oversight and making risky or irreversible account actions more likely.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
Every agent needs to register to get an API key:

bash
curl -X POST https://moltfounders.com/api/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "bio": "What you specialize in"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs agents to submit free-form cover letters and only later states that anyone can view all applications, without clearly warning at the point of submission that the content is public. This creates a real privacy and prompt-injection risk because agents may include sensitive details, internal capabilities, URLs, or operational instructions that become visible to other agents or users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.