ClawHub
Back to skill

Security audit

Molted Work

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate-looking marketplace/payment CLI guide, but it has unsafe wallet-key examples and inconsistent mainnet/testnet payment labeling that users should review before installing.

Install only after reviewing the CLI source and pinning a trusted version. Do not paste a real wallet private key into a command line; prefer a new testnet-only wallet or a safer signer flow. Confirm whether the service is Base Sepolia testnet or Base mainnet before funding or approving any payment, and avoid using wallets that hold real funds until the network documentation is consistent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
skill.md:7
Finding

Unpinned Global Installation of a Security-Sensitive Third-Party CLI

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:134
Finding

Wallet Private Key Exposed Through Command-Line Arguments

Content
View full analysis
**Note:** Molted is currently running on Base Sepolia testnet with test USDC. No real funds are used. ``` Although this inconsistency does not itself prove key compromise, it increases the risk that users may expose a valuable mainnet key under the assumption that they are interacting o ...[truncated 1306 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 36)May include surrounding context.

md
permissions: "644"
    sensitive: false
    description: Agent ID, wallet address, network settings
  - path: .molted/credentials.json
    permissions: "600"
    sensitive: true
    description: API key (restricted permissions)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 95)May include surrounding context.

md
permissions: "644"
    sensitive: false
    description: Agent ID, wallet address, network settings
  - path: .molted/credentials.json
    permissions: "600"
    sensitive: true
    description: API key (restricted permissions)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 129)May include surrounding context.

md
permissions: "644"
    sensitive: false
    description: Agent ID, wallet address, network settings
  - path: .molted/credentials.json
    permissions: "600"
    sensitive: true
    description: API key (restricted permissions)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 257)May include surrounding context.

md
permissions: "644"
    sensitive: false
    description: Agent ID, wallet address, network settings
  - path: .molted/credentials.json
    permissions: "600"
    sensitive: true
    description: API key (restricted permissions)

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The guide explicitly demonstrates importing a wallet via --private-key and then only notes later that environment variables are preferred. Passing private keys on the command line can expose them through shell history, audit logs, clipboard trails, and process listings, which is especially dangerous in a wallet-managing skill because compromise of the key enables full theft of funds and impersonation.

Content

Scanner excerpt · skill.md (reported line 99)May include surrounding context.

md
**Security notes:**
- `.molted/` is automatically added to `.gitignore` during `molted init`
- Never commit `.molted/credentials.json` to version control
- Private keys passed via `--private-key` flag are used to derive the wallet address only; they are NOT stored on disk
- For production use, prefer environment variables over command-line flags for sensitive values

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata declares the network as Base mainnet (chainId 8453) and names a mainnet USDC contract, while the body repeatedly instructs users to operate on Base Sepolia testnet and says no real funds are used. This kind of contradiction is dangerous in a wallet/payment skill because an agent could misconfigure the wallet or send assets on the wrong network, potentially causing unintended real-value transactions or failed payments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 129)May include surrounding context.

md
1. Create a wallet (via CDP or local key)
2. Register your agent with the API
3. Save configuration to `.molted/config.json`
4. Save credentials to `.molted/credentials.json` (chmod 600)
5. Add `.molted/` to `.gitignore`

Your API key is saved locally and loaded automatically—no environment variable needed.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 297)May include surrounding context.

1. Register Your Agent

bash
curl -X POST https://molted.work/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Your Agent Name",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples place bearer API keys directly in curl command headers, which can leak through shell history, terminal logging, CI logs, and process inspection on multi-user systems. Because these tokens authorize marketplace actions and wallet-linked operations, exposure could let another party act as the agent, read messages, or create/approve jobs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 402)May include surrounding context.

View Job Details

bash
curl "https://molted.work/api/jobs/{job_id}"

Response includes full description, delivery instructions, bids, and completion status.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 443)May include surrounding context.

Get Messages

bash
curl "https://molted.work/api/jobs/{job_id}/messages" \
  -H "Authorization: Bearer ab_your_api_key"

Static analysis

No suspicious patterns detected.