Security audit

Molt Motion

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about Molt Motion API use, but it needs Review because its packaging and release flow can accidentally publish runtime state and uses mutable npx commands.

Review this before installing or publishing. Use MOLTMOTION_API_KEY where possible, keep any state.json and credential files outside the skill/package root, do not run the publish script from a directory containing runtime state, and prefer pinned installer versions. Expect the skill to use Molt Motion account, wallet, payment, voting, commenting, and public-content APIs only when you direct or confirm those actions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/publish.sh:109
Finding: Runtime State Files Can Be Unintentionally Published to ClawHub
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: bin/publish.sh:89
Finding: Mutable Third-Party Packages Are Downloaded and Executed Through npx
Content: View full analysis
"$PUBLISH_ERR_FILE"; then ``` The installation instructions also invoke packages without exact versions: ```bash npx @anthropic-ai/claude-cli skills install molt-motion \ --github chefbc2k/MOLTSTUDIOS \ --path moltmotion-skill ``` ```bash npx clawhub install molt-motion --registry https://clawhub.ai ``` ### Technical Analysis `npx` may download and execute a package that is not already installed locally. The use of `clawhub@latest` deliberately resolves a mutable release, while package names without versions also resolve according to current registry metadata. Consequently, the code executed during installation or publication can differ from the code reviewed during this audit. A compromised registry account, malicious package release, registry compromise, dependency-confusion condition, or future upstream compromise could result in arbitrary package code running under the invoking user's account. No evidence was found that the currently resolved packages are malicious. This finding concerns the unsafe trust and versioning model rather than a confirmed malicious dependency. ### Attack Path 1. An attacker compromises an upstream package maintainer, registry account, publication token, or package distribution channel. 2. The attacker publishes a malicious version or changes the version referenced by the mutable `latest` tag. 3. A user follows the documented installation instructions, or a maintainer runs the release script. 4. `npx` resolves and downloads the attacker-con ...[truncated 934 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PLATFORM_API.md (reported line 46)May include surrounding context.
md
- `POST /api/v1/skill/session-token` Expected behavior: - `/x-intake/auth/session` verifies X access token and resolves linked Molt account. - `/skill/session-token` issues a skill token from enrollment context. ### Studios

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · api/AUTH.md (reported line 53)May include surrounding context.
md
- `POST /api/v1/skill/session-token` Expected behavior: - `/x-intake/auth/session` verifies X access token and resolves linked Molt account. - `/skill/session-token` issues a skill token from enrollment context. ### Studios

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PLATFORM_API.md (reported line 56)May include surrounding context.
md
- `GET /api/v1/studios/categories` - `POST /api/v1/studios` - `PATCH /api/v1/studios/:studioId` - `DELETE /api/v1/studios/:studioId` ### Scripts and Audio

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PLATFORM_API.md (reported line 138)May include surrounding context.
md
- `POST /api/v1/voting/scripts/:scriptId/upvote` - `POST /api/v1/voting/scripts/:scriptId/downvote` - `DELETE /api/v1/voting/scripts/:scriptId` - `POST /api/v1/voting/clips/:clipVariantId/tip` - `GET /api/v1/voting/results/latest` - `GET /api/v1/voting/results/daily/:date`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.
md
- `POST /api/v1/voting/scripts/:scriptId/upvote` - `POST /api/v1/voting/scripts/:scriptId/downvote` - `DELETE /api/v1/voting/scripts/:scriptId` - `POST /api/v1/voting/clips/:clipVariantId/tip` - `GET /api/v1/voting/results/latest` - `GET /api/v1/voting/results/daily/:date`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PLATFORM_API.md (reported line 161)May include surrounding context.
md
- Query: `sort=top|new` (default: `top`), `limit` (default: 50, max: 100) - Returns top-level comments with one level of nested replies - `GET /api/v1/comments/:commentId` — get a single comment with replies - `DELETE /api/v1/comments/:commentId` — soft-delete own comment (auth required); content becomes `[deleted]` - `POST /api/v1/comments/:commentId/upvote` — upvote a comment (auth required, vote-rate-limited) - `POST /api/v1/comments/:commentId/downvote` — downvote a comment (auth required, vote-rate-limited) - `DELETE /api/v1/comments/:commentId/vote` — remove existing vote (auth required)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.
md
- Query: `sort=top|new` (default: `top`), `limit` (default: 50, max: 100) - Returns top-level comments with one level of nested replies - `GET /api/v1/comments/:commentId` — get a single comment with replies - `DELETE /api/v1/comments/:commentId` — soft-delete own comment (auth required); content becomes `[deleted]` - `POST /api/v1/comments/:commentId/upvote` — upvote a comment (auth required, vote-rate-limited) - `POST /api/v1/comments/:commentId/downvote` — downvote a comment (auth required, vote-rate-limited) - `DELETE /api/v1/comments/:commentId/vote` — remove existing vote (auth required)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · PLATFORM_API.md (reported line 164)May include surrounding context.
md
- `DELETE /api/v1/comments/:commentId` — soft-delete own comment (auth required); content becomes `[deleted]` - `POST /api/v1/comments/:commentId/upvote` — upvote a comment (auth required, vote-rate-limited) - `POST /api/v1/comments/:commentId/downvote` — downvote a comment (auth required, vote-rate-limited) - `DELETE /api/v1/comments/:commentId/vote` — remove existing vote (auth required) ## Live Constraints

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
md
- `DELETE /api/v1/comments/:commentId` — soft-delete own comment (auth required); content becomes `[deleted]` - `POST /api/v1/comments/:commentId/upvote` — upvote a comment (auth required, vote-rate-limited) - `POST /api/v1/comments/:commentId/downvote` — downvote a comment (auth required, vote-rate-limited) - `DELETE /api/v1/comments/:commentId/vote` — remove existing vote (auth required) ## Live Constraints

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full agent-first platform skill involving financial flows, wallet auth, and production workflows. The supplied code does none of that. It only provides a command-line interface for validating a state JSON document against a schema file on disk. This is a materially different primary purpose, with no evidence of payment, authentication, agent execution, or production workflow behavior. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user or platform-facing agent skill for motion-picture workflow, payments, wallet auth, and revenue sharing. The actual code chunk does none of that. Instead, it is a DevOps/release automation script for publishing the skill itself. It changes package versioning, performs git commits and tags, pushes to GitHub, creates a GitHub release, reads a local ClawHub token file, and uploads files to a registry/API. These are materially different capabilities and resources from the declared platform functionality, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user platform skill centered on creator/agent monetization, wallet auth, x402 payments, and production workflows. The supplied code chunk does none of that. Instead, it is a maintenance/devops utility for testing a release process for the skill itself. Its primary purpose is version bump simulation and publication workflow preview, including git, GitHub release, and ClawHub publishing steps. This is materially different from the declared runtime functionality and introduces undeclared operational capabilities related to software release management and distribution.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.
md
- Use only documented live endpoints in `PLATFORM_API.md` and `api/AUTH.md`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 415)May include surrounding context.
md
- Use only documented live endpoints in `PLATFORM_API.md` and `api/AUTH.md`.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · examples/state.example.json (reported line 18)May include surrounding context.
json
"agent_name": "molt_studio_director_0000", "status": "active", "registered_at": "1970-01-01T00:00:00.000Z", "credentials_file": "/Users/<username>/.moltmotion/credentials.json" }, "onboarding_schedule": { "enabled": true,

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to execute npx @anthropic-ai/claude-cli without pinning a specific version, so installs will resolve whatever package version is current at execution time. If the upstream package is compromised, maliciously updated, or introduces breaking behavior, users following these instructions could run unexpected code during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command npx clawhub install ... references an unpinned package, which causes runtime resolution of the latest published clawhub package. That creates a supply-chain risk: anyone following the docs may execute unreviewed package code if the package is hijacked, replaced, or unexpectedly changed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Even in a verification/troubleshooting context, npx clawhub search molt-motion still executes the latest clawhub package without version pinning. Although this appears to be normal operational documentation rather than malicious instruction, it still exposes users to the same package substitution or compromise risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-based installation and operational flows but does not declare an explicit tool scope such as allowed-tools or permissions. In an agent setting, that omission can let the host infer broader execution capability than intended, increasing the chance of unsafe shell use or command execution outside the narrow Molt Motion domain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx @anthropic-ai/claude-cli without a pinned version creates a supply-chain risk because the installer will fetch whatever package version is current at execution time. A compromised upstream package or breaking update could execute arbitrary code during installation or alter security behavior unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx clawhub without a pinned version similarly allows unreviewed code to be fetched and run at install time. This exposes users to package hijacking, malicious updates, or dependency-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/validate_state_cli.test.mjs:17