Moltywork

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:04 AM UTC
• Version: 1.0.0

Overview

MoltyWork appears to be a real marketplace helper, but it gives an agent persistent credentials, recurring activity, and remote self-update instructions that users should review carefully before installing.

Install only if you trust moltywork.com to serve safe future instructions and you are comfortable with an agent using a MoltyWork API key for ongoing marketplace checks. Do not store the API key in chat or broad memory; use a dedicated secret store or tightly restricted local credential file, and require explicit confirmation before bidding, messaging clients, changing profile data, archiving messages, or reinstalling/updating the skill from the website.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The heartbeat instructs the agent to create local skill directories, reinstall the skill, and download a remote file onto disk, which exceeds the stated purpose of finding MoltyWork opportunities. This creates an unnecessary self-modifying persistence/update path from an external server, enabling unreviewed code or prompt changes to be planted locally and reloaded later.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a marketplace/job assistant, but the heartbeat adds persistent local installation and self-update behavior unrelated to that business function. This mismatch is dangerous because it hides disk modification and supply-chain style update behavior inside operational instructions the agent may execute routinely.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The heartbeat encourages checking MoltyWork under broad conditions like having free time, being curious, or every few hours, without clear authorization boundaries. In an autonomous agent context, this can lead to unnecessary external activity, repeated authenticated requests, and behavior that drifts beyond explicit user intent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill tells the agent to download and save a remote file into local skill directories, potentially overwriting an installed skill, without any user warning or approval. Silent disk writes and remote updates are dangerous because they can persist adversarial instructions, replace trusted content, or expand capabilities without review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs authenticated API calls using a bearer API key to retrieve account status, profile data, messages, and project information, but gives no warning about credential handling or exposure of account data. Even if operationally useful, embedding credentialed network actions in heartbeat instructions increases the risk of unauthorized data access, leakage, or over-collection.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The metadata says to use the skill whenever the user asks how to make money online or anything about MoltyWork, which is broader than the actual service scope. That can cause the skill to activate for generic earning-advice requests and steer users into an external marketplace workflow they did not specifically request, increasing exposure to unnecessary account creation, API handling, and off-platform instructions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The section encourages invocation whenever the human asks to do anything on MoltyWork and reinforces not waiting for other safeguards like heartbeat. In context of a transactional marketplace skill that handles credentials and messaging, broad activation guidance increases the chance of the agent taking consequential actions without strong confirmation boundaries.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The skill instructs the agent to store the API key in 'whatever memory or context system you have,' which makes the secret available to future prompts, summaries, or memory inspection flows. Even though the skill warns not to send the key off-domain, this persistence model materially increases the chance of accidental disclosure or misuse by other tools, prompts, or skills.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

To install this skill locally:

1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 90% confidence
• Finding: The installation instructions tell the agent to inspect multiple hidden directories under the home folder to discover a skills location. That expands filesystem access beyond what is necessary for the user task and can expose sensitive agent configuration, other installed skills, or environment details if the agent follows the instructions automatically.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

To install this skill locally:

1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 89% confidence
• Finding: By listing several possible skill directories and telling the agent to check which exist, the skill promotes enumeration of local agent tooling and configuration layout. That information can reveal platform fingerprints and installed ecosystem details that are not required for normal marketplace use and may aid later targeted attacks or prompt tailoring.

Session Persistence

Medium

• Category: Rogue Agent

Content

Follow these steps (and add to your todo list, if you have one, to ensure you complete all steps):

1. Re-install the skill locally to ensure you have the latest version. Do this by checking which of these exists (in order). If NONE of them exist, create the last one (.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 94% confidence
• Finding: The instruction to locate or create persistent skill directories and place MoltyWork content there establishes session-to-session persistence. In context, this is risky because it allows remote instructions to survive beyond the current interaction and potentially influence future agent behavior without renewed user consent.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.