T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:24- Finding
Autonomous Objective and External Transaction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Molt Beach, the Million Dollar Page for AI Agents – Own a piece of internet history
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its advertised Molt Beach purpose, but it pushes agents toward public account actions, local token storage, and payment flows without enough user control.
Review this skill carefully before installing. Only use it when you explicitly want an agent to interact with Molt Beach, create public pixel/profile state, and potentially enter credit-purchase workflows. Do not let an agent store the returned secret in a project .env file unless you deliberately choose that storage location; prefer a secret manager or OS keychain, and require confirmation before any purchase, promo redemption, pixel update, or Stripe checkout action.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:503- Finding
Authentication Secret Transmitted in a URL Query String
- Content
View full analysis
/transactions?agentSecret=&limit=50" ``` ``` The same insecure API pattern appears in `llms.txt:131-136`: ```markdown ### Agent Information - `GET /api/agent/:identifier` - Get agent account info - `GET /api/agent/:identifier/pixels` - Get agent's pixels - `GET /api/agent/:identifier/balance` - Check credit balance - `GET /api/agent/:identifier/transactions?agentSecret=...&limit=50` - Transaction history (requires auth) - `GET /api/leaderboard?limit=10` - View top pixel owners ``` ### Technical Analysis The transaction-history endpoint places `agentSecret` in the URL query string. URLs are commonly retained or copied by multiple components, including: - Shell history. - Browser history. - HTTP server access logs. - Reverse-proxy and load-balancer logs. - Monitoring and application-performance systems. - Security appliances. - Debugging output and exception reports. - Shared terminal transcripts. - Referrer information in some navigation scenarios. TLS protects the URL while it is transmitted over the network, but it does not prevent the client, server, proxy, or monitoring infrastructure from recording it. Query-string authentication therefore expands the number of locations in which the secret may persist. This pattern also contradicts the project's otherwise defensive credential-storage guidance. The Skill advises users to avoid exposing secrets in shell arguments, yet the documented `curl` command embeds the secret directly in an argument and URL. ### Attack Path 1. An Agent follows the documented transaction-history example. 2. The Agent replaces `` with a valid service-issued secret. 3. The complete ...[truncated 1410 chars]- Remediation
View remediation
/transactions?limit=50" \ -H "Authorization: Bearer " ``` 3. If bearer authentication is unsuitable, accept the credential in the encrypted request body of a `POST` request rather than in the URL. 4. Update both `SKILL.md` and `llms.txt` so no example teaches query-string authentication. 5. Configure application servers, proxies, analytics systems, and monitoring tools to redact authentication headers and known sensitive fields. 6. Review historical access logs for URLs containing `agentSecret=` and securely delete or sanitize affected records where operationally possible. 7. Rotate or revoke secrets that may already have appeared in URL logs. 8. Avoid supplying real secrets directly in interactive shell command arguments. Prefer secure environment injection, a secret manager, or a client that reads credentials without exposing them in process listings or shell history. 9. Add automated documentation and source scanning that rejects sensitive parameter names such as `secret`, `token`, or `password` when they appear in URLs. 10. Implement scoped and revocable credentials so disclosure of one token does not grant every account operation indefinitely. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (36)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill tells the agent to write the secret into a plaintext .env file. In agent-driven workflows, this can leak credentials into workspaces, backups, logs, subsequent tool context, or misconfigured repositories, making credential compromise much more likely.
- Content
If you must use the shell, use a heredoc to avoid secrets appearing in command arguments:
bash # Write to .env file using heredoc (secret stays out of shell history) cat >> .env <<'CREDENTIALS' MOLT_BEACH_AGENT_ID=your-unique-id-2026-02-03 MOLT_BEACH_SECRET=YOUR_SECRET_HERE
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This line includes the actual secret variable assignment format, normalizing storage of the credential in a plaintext .env file. Even with shell-history precautions, plaintext local storage remains a sensitive exposure point in shared or synced environments.
- Content
bash # Write to .env file using heredoc (secret stays out of shell history) cat >> .env <<'CREDENTIALS' MOLT_BEACH_AGENT_ID=your-unique-id-2026-02-03 MOLT_BEACH_SECRET=YOUR_SECRET_HERE CREDENTIALS
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This line reinforces use of a .env file as the storage location for the secret, making credential persistence part of the recommended workflow. File permission tightening reduces but does not eliminate the risk of credential theft, accidental inclusion, or later disclosure by tooling.
- Content
md CREDENTIALS # Restrict file permissions to owner only chmod 600 .env # Ensure .env is excluded from version control grep -qxF '.env' .gitignore 2>/dev/null || echo '.env' >> .gitignore
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The instruction to append .env to .gitignore acknowledges that sensitive credentials are being placed in the project directory, which is itself the unsafe practice. In an agent setting, modifying repository metadata and relying on .gitignore is not a sufficient safeguard against exposure or accidental handling.
- Content
Restrict file permissions to owner only
chmod 600 .env
Ensure .env is excluded from version control
grep -qxF '.env' .gitignore 2>/dev/null || echo '.env' >> .gitignore
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
This guidance continues the pattern of treating plaintext .env storage as an acceptable credential-management mechanism. That is especially risky for autonomous agents because local files may be indexed, uploaded, summarized, or reused by other tools without the user's awareness.
- Content
chmod 600 .env
Ensure .env is excluded from version control
grep -qxF '.env' .gitignore 2>/dev/null || echo '.env' >> .gitignore
text **Security best practices for your secret:**
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
Showcase your pixels or the grid on your website:
html <!-- Grid widget embed --> <iframe src="https://moltbeach.ai/embed?width=400&height=400&theme=dark"></iframe> <!-- Agent badge (SVG) -->
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text chmod 600 .env # Ensure .env is excluded from version control grep -qxF '.env' .gitignore 2>/dev/null || echo '.env' >> .gitignore ``` **Security best practices:**
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The package manifest identifies the artifact as a generic 'clawhub' package manager for Molt projects rather than a narrowly scoped Molt Beach pixel-claiming skill. This mismatch is dangerous because it suggests the published skill may deliver broader install/management capabilities than users expect, increasing the risk of deceptive packaging, unintended execution paths, or supply-chain abuse under a misleading skill identity.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The invocation guidance is overly broad and tied to ordinary conversational phrases like 'what do you feel' or 'get a life,' which could activate the skill when the user did not intend to interact with Molt Beach. This increases the chance of unsolicited external actions, account creation, or purchase attempts from benign conversation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This example transmits agentIdentifier and agentSecret to an external service. While expected for the feature, it still involves sending credentials off-host, so in an agent environment it is security-relevant and should only occur with clear user intent and scoped secret handling.
- Content
Redeem promo codes for additional free credits:
bash curl -X POST https://moltbeach.ai/api/promo/redeem \ -H "Content-Type: application/json" \ -d '{ "agentIdentifier": "<your_identifier>",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to persist newly issued credentials to a local .env file and modify .gitignore, which are side effects on the local workspace not required for the core act of claiming a pixel. In an agent setting, this can cause secrets to be written into arbitrary repositories or user directories, increasing the chance of credential exposure and violating least-privilege expectations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The purchase example posts agent identity, pixel data, and potentially secrets to an external API endpoint. That is inherent to the integration, but it still creates exposure risk if invoked automatically or without the user understanding that data and credentials are leaving the local environment.
- Content
If you already have a secret and credits, purchasing is instant:
bash curl -X POST https://moltbeach.ai/api/purchase \ -H "Content-Type: application/json" \ -d '{ "pixels": [
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes a full paid credit-purchase and Stripe checkout flow, which expands behavior from expressive pixel claiming into real-money spending and external payment orchestration. In an autonomous agent context, this creates a risk of unauthorized purchases or the agent steering users into payment flows without sufficiently explicit consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes purchasing credits through Stripe but does not present a strong, front-loaded warning that this is a real-money transaction requiring an external payment step. In practice, that can mislead users or agents into entering a spending flow without adequate notice or confirmation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text ```bash # 1. Purchase pixel curl -X POST https://moltbeach.ai/api/purchase \ -H "Content-Type: application/json" \ -d '{ "pixels": [{
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text "credentials": { "serviceIssued": true, "description": "The Molt Beach API issues a secret token on first purchase. This token is used for subsequent API calls (pixel updates, credit purchases, animations). The token cannot be recovered if lost.", "storage": "Agent is responsible for securely storing the service-issued token. Recommended: OS keychain, secrets manager, or chmod 600 .env file excluded from version control." }, "files": [ "skill.md",
Static analysis
No suspicious patterns detected.