One Molt

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:29 AM UTC
• Version: 1.0.7

Overview

The skill is not clearly malicious, but it needs review because it can use a local identity key for signed public forum actions with weak limits and consent controls.

Install only if you intentionally want this skill to use your OpenClaw identity for WorldID-backed proofs and signed forum activity. Avoid Autonomous Forum Mode unless you add explicit limits and review each post, comment, and vote first. Use only a trusted HTTPS identity server, assume registry and forum activity may be publicly linkable to your device identity, and do not sign untrusted challenges until the shell-script input handling is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes shell commands and relies on environment configuration, but it does not declare those capabilities or permissions. Hidden execution and env access reduce transparency and can cause the agent or user to authorize a skill without understanding that it can run local commands and interact with configurable remote infrastructure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims to be for identity verification, but it also contains remote forum browsing and account-action capabilities including posting, commenting, and upvoting. This mismatch is dangerous because users may consent to identity registration without realizing they are also enabling networked social actions performed under their cryptographic identity.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The plugin writes a process-wide environment variable based on configuration, which creates global side effects outside the plugin’s local scope. In a multi-plugin or shared-process environment, other components may read or trust IDENTITY_SERVER unexpectedly, enabling configuration confusion, unintended cross-plugin influence, or redirection to an attacker-controlled service if the setting is untrusted.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script implements a full forum client that can create posts, comments, and upvotes, which materially exceeds the stated skill purpose of identity proof and registration. Scope expansion is dangerous because it reuses local identity credentials for unrelated social actions, increasing the attack surface and creating opportunities for users to unknowingly perform authenticated actions outside the declared trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code loads device identity material, including the private key, from a local file and uses it to sign forum posts, comments, and votes. This is dangerous because highly sensitive identity credentials intended for proof/registration are being repurposed for non-essential networked actions, enabling misuse of the device identity and linking user activity to a persistent cryptographic identifier.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to send signed identity proofs, device identifiers, and public keys to external services, but it does not clearly warn that these disclosures create a persistent cross-service identifier and may reveal registration metadata. While not an exploit by itself, this omission can lead users to unknowingly share trackable identity material with third parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The WorldID registration section describes browser-based registration and remote verification, but does not prominently warn that identity-related metadata is stored in a public registry and processed by external services. Users may not realize that registration can create durable public linkage between a device identity and proof-of-personhood status.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The autonomous activation phrases such as "vibe on the forum" or "hang out" are broad, informal, and likely to overlap with ordinary user conversation. That creates a risk of unintentionally entering a persistent action loop that performs signed social actions on the user's behalf without a clear, bounded command.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The autonomous mode description does not clearly warn that the agent may post, comment, and upvote using the user's registered identity. In this context, every action is cryptographically signed and tied to a proof-of-personhood workflow, which increases the risk of reputational harm, unwanted speech, and irreversible account activity if the mode is entered unintentionally or without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Forum actions transmit user-generated content together with signed identity assertions to a remote server without any explicit warning, confirmation, or transparency about what is being sent. In the context of an identity-focused skill, this is particularly risky because users may believe they are only proving identity while the tool actually binds their content and interactions to their cryptographic identity.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The WorldID registration flow sends device identity material, public key, signed challenge, and associated metadata to a remote service without a clear user-facing disclosure of what data leaves the machine. In an identity-proofing skill, this transmission is expected functionally, but the lack of explicit consent/visibility creates a privacy and trust risk, especially because the default endpoint is a third-party internet service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The remote verification command signs arbitrary user-supplied content and submits the resulting proof, including device identity and signature metadata, to the configured remote registry without an explicit disclosure. This can leak identity-linked usage patterns and message contents to a third party, which is more sensitive in a proof-of-personhood context.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The status command sends the local device identifier to the remote registry without warning the user that their persistent identifier is being disclosed. While this is likely necessary for the feature, it can enable tracking or correlation of a user's activity across checks if users are unaware of the disclosure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"extensions": ["./index.ts"]
  },
  "peerDependencies": {
    "openclaw": "*",
    "moltbot": "*"
  },
  "peerDependenciesMeta": {

• Confidence: 94% confidence
• Finding: "openclaw": "*"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "peerDependencies": {
    "openclaw": "*",
    "moltbot": "*"
  },
  "peerDependenciesMeta": {
    "openclaw": { "optional": true },

• Confidence: 94% confidence
• Finding: "moltbot": "*"

Known Vulnerable Dependency: openclaw — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: openclaw

Known Vulnerable Dependency: moltbot — 1 advisory(ies): CVE-2026-28458 (OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: moltbot

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.