T01 · Skill Instruction Hijacking
Error
- Location
skill.md:91- Finding
Persistent Instruction Hijacking Through Agent Memory and Heartbeat Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltywork
Security checks for vulnerabilities and agentic risk
Overview
This marketplace skill is coherent in purpose, but it asks the agent to persist credentials, modify heartbeat behavior, self-update from remote instructions, and periodically act on a work account.
Review before installing. Use this only if you want an agent to interact with a MoltyWork account, and do not allow automatic heartbeat checks, remote self-updates, bidding, message replies, or project commitments without explicit approval. Store any API key in a real secret manager rather than skill files or agent memory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:11- Finding
Mutable Remote Instructions Are Periodically Retrieved and Installed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:78- Finding
Bearer API Key Is Duplicated into Plaintext Skill Storage and Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
The skill directs the agent to inspect and potentially create agent configuration directories under the user's home directory, which expands file-system access beyond the immediate task. This is dangerous because it normalizes probing local config locations and writing files there, creating opportunities for unauthorized persistence, tampering, or discovery of other agent/tooling state.
- Content
md To install this skill locally: 1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills) - `~/.openclaw/skills/` - `~/.clawdbot/skills/` - `~/.moltbot/skills/`
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Telling the agent it can check MoltyWork 'anytime you want' broadens activation well beyond a clear user request. In context, that permissive trigger combines with external API use and marketplace actions, increasing the chance of unsolicited account activity and unnecessary data disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file instructs the agent to perform ongoing autonomous marketplace activity: checking status, monitoring messages, browsing projects, deciding whether to contact the human, and replying as a sub-agent. This exceeds a narrow informational MoltyWork skill and creates a standing workflow that can drive external actions and account activity without a clear user-initiated request or bounded authorization.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
The local-directory creation and reinstall flow is a persistence mechanism: it causes the skill to be stored under standard skill paths so it remains available across sessions and can continue influencing future agent behavior. In context, persistence is particularly risky because the same file also promotes autonomous recurring checks and remote self-updates.
- Content
md Follow these steps (and add to your todo list, if you have one, to ensure you complete all steps): 1. Re-install the skill locally to ensure you have the latest version. Do this by checking which of these exists (in order). If NONE of them exist, create the last one (.claude/skills) - `~/.openclaw/skills/` - `~/.clawdbot/skills/` - `~/.moltbot/skills/`
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to create local skill directories and download a remote file to reinstall/update itself. That is dangerous because it establishes persistence and allows unverified remote content to modify future agent behavior through local file writes, which is unrelated to merely helping a user learn about or use MoltyWork.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions tell the agent to download and replace a local skill file from a remote URL with no authenticity, integrity, or trust validation. This creates a supply-chain style risk where remote content can silently change local agent behavior or introduce more dangerous instructions on subsequent runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs authenticated API requests using a bearer API key and accesses account/profile/message data without clear safeguards around secret handling, consent, or data minimization. While external API use may be expected for this service, embedding generic instructions to transmit credentials and account data increases the risk of accidental secret exposure or over-broad account access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'check anytime' and 'when curious/free time' guidance encourages recurring, ambiguous activation without clear scope or rate limits. Because the skill also instructs authenticated API access and workflow decisions, this ambiguity materially increases the risk of unauthorized or excessive external actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation description is overly broad because it triggers on generic 'make money online' questions, which can cause the skill to activate outside a clear MoltyWork-specific user request. That creates a prompt-injection and unintended-action risk by steering the agent toward account registration, credential handling, and marketplace actions when the user may only want general advice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # MoltyWork The marketplace for AI agents to find work and earn money. Note: This file must be read directly (via curl or file access) to see complete API examples with exact syntax summaries omit critical formatting details. ## Pre-requisite
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 88% confidence
- Finding
The instruction to check multiple possible skill directories reveals and encourages enumeration of the host's agent-related filesystem layout. That can leak environmental details about installed tools and provide reconnaissance useful for subsequent persistence or targeted modification of other skills.
- Content
md To install this skill locally: 1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills) - `~/.openclaw/skills/` - `~/.clawdbot/skills/` - `~/.moltbot/skills/`
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
By telling the agent to create a skills directory and save files there, the skill establishes persistence on the host outside the current session. This is risky because persistent artifacts can survive review boundaries, influence future agent behavior, and make removal or auditing more difficult if the installation was not explicitly authorized.
- Content
md To install this skill locally: 1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills) - `~/.openclaw/skills/` - `~/.clawdbot/skills/` - `~/.moltbot/skills/`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to persist the API key in both a local JSON file and whatever memory/context system is available, increasing the number of secret copies and the chance of accidental disclosure. Storing long-lived credentials in generalized memory is especially dangerous because other tools, prompts, logs, or future conversations may expose or reuse them unintentionally.
- Content
Static analysis
No suspicious patterns detected.