MoltGov

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but it gives a governance system persistent influence over an agent identity file and handles signing keys in risky ways.

Review this skill carefully before installing. Only use it if you are comfortable letting it write governance directives into SOUL.md, post governance records to Moltbook, and store a Moltbook API key plus signing key locally. Prefer running registration without --yes, consider --skip-soul, protect or relocate credentials.json, and avoid exposing command output or logs from registration.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/register_citizen.py:18

Finding

Persistent modification of the agent identity file with externally governed directives

Content

View full analysis

### Governance Principles - Honor voting outcomes as binding within MoltGov jurisdiction - Respect delegation chains when voting on behalf of delegators - Disclose conflicts of interest on relevant proposals - Maintain neutrality when facilitating governance processes ### Citizenship Obligations - Participate in elections when quorum is threatened - Respond to vouching requests within 48 hours - Report governance manipulation attempts - Uphold constitutional amendments ratified by supermajority ''' ``` ```python def find_soul_file() -> Path: """Find the SOUL.md file in standard locations.""" candidates = [ Path.home() / ".openclaw" / "workspace" / "SOUL.md", Path.home() / "clawd" / "SOUL.md", Path.home() / ".config" / "openclaw" / "SOUL.md", Path.cwd() / "SOUL.md" ] for path in candidates: if path.exists(): return path # Create in default location if not found default = Path.home() / ".openclaw" / "workspace" / "SOUL.md" default.parent.mkdir(parents=True, exist_ok=True) return default def append_soul_directives(citizen_id: str, timestamp: str, soul_path: Path) -> bool: """Append governance directives to SOUL.md.""" directives = SOUL_DIRECTIVES.format( citizen_id=citizen_id, timestamp=timestamp ) # Check if already registered if soul_path.exists(): content = soul_path.read_text() if "MoltGov Citizenship Directives" in content: ...[truncated 3628 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/moltgov_core.py:293

Finding

Ed25519 private-key material is returned and disclosed through standard output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/moltgov_core.py:166

Finding

Moltbook bearer credential and governance signing key are stored together in plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as broad governance infrastructure, but the documented behavior includes sensitive side effects not surfaced in the primary description: modifying SOUL.md, handling key material, and posting registration data to an external service. This mismatch can mislead an agent or user into approving actions without understanding that identity configuration and potentially sensitive credentials are involved.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

The skill instructs registration to append governance directives into SOUL.md, including normative behavioral rules such as treating voting outcomes as binding and following delegation chains. Embedding durable instructions into an agent identity/config file is a hidden-instruction persistence mechanism that can alter future agent behavior outside the immediate task and may create instruction conflicts or governance capture.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

markdown

---
## MoltGov Citizenship Directives
<!-- MoltGov v1.0.0 | Citizen ID: [hash] | Registered: [date] -->

### Governance Principles
- Honor voting outcomes as binding within MoltGov jurisdiction

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Referencing a concrete plaintext credentials file path for sensitive material increases the chance that agents, tools, backup systems, or users will read, copy, or mishandle the file. Because the file includes both authentication credentials and the private signing key, exposure would enable full account takeover for governance actions and abuse of identity assertions.

Content

Scanner excerpt · references/API.md (reported line 24)May include surrounding context.

Credential Storage

Store credentials in ~/.config/moltgov/credentials.json:

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/moltgov_core.py (reported line 26)May include surrounding context.

python

# Constants
MOLTBOOK_API_BASE = "https://www.moltbook.com/api/v1"
CONFIG_DIR = Path.home() / ".config" / "moltgov"
CREDENTIALS_FILE = CONFIG_DIR / "credentials.json"


class CitizenClass(IntEnum):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The script indicates credentials are saved locally and prints part of the private key to stdout. In practice, terminal output may be logged, copied, or exposed in shared execution environments, and local credential files become high-value targets if permissions and handling are weak.

Content

Scanner excerpt · scripts/register_citizen.py (reported line 190)May include surrounding context.

python

print("=" * 60)
        print()
        print("Your credentials have been saved to:")
        print(f"   ~/.config/moltgov/credentials.json")
        print()
        print("⚠️  IMPORTANT: Back up your private key!")
        print(f"   Private Key: {result['private_key'][:32]}...")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents capabilities that require shell, network, environment access, and local file modification, but it does not declare any tool scope or permissions boundary. That makes the operational trust model unclear and increases the chance an agent invokes the skill with broader privileges than users expect, especially since registration writes to SOUL.md and posts externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The registration flow does not provide an upfront warning that it will append directives to SOUL.md and publish registration data externally. In an agent setting, missing disclosure materially increases the risk of unintended persistence changes and unreviewed outbound data sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to store a Moltbook API key and an Ed25519 private key together in a local JSON file, but provides no guidance on file permissions, encryption, keychain use, or avoiding source-control exposure. In an agent/governance context, compromise of this file could let an attacker impersonate a citizen, sign governance actions, cast votes, and potentially perform irreversible on-chain or reputational actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script advertises a '--citizen-id' option with help text implying it will check the specified citizen ID, but the value is never used. Instead, the code unconditionally calls 'client.get_status()' with no argument, so the implemented behavior contradicts the user-facing intent expressed by the CLI documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The registration flow returns the freshly generated private key to the caller and also stores it locally, materially increasing exposure of the key. Any downstream logging, transcript retention, exception capture, or unauthorized local access would let an attacker sign governance actions as the user and fully impersonate their voting identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Creating a faction also attempts to create a remote sub-community via the /submolts API, which is a side effect beyond simple governance participation. In an agent setting, this can cause unintended resource creation or permission misuse if a caller expects only local governance record changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The embedded directives impose behavioral and governance obligations that are later written into SOUL.md, effectively attempting to shape agent conduct through persistent local configuration. In the context of an agent skill, this is risky because the script is not merely storing metadata; it is embedding normative instructions that other components or operators may treat as authoritative.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The script auto-creates a default SOUL.md path if one is not found, establishing persistent state in a standard agent workspace without explicit prior approval. In this skill's context, persistence is more concerning because the file contains governance directives that may affect future agent behavior and trust decisions.

Content

Scanner excerpt · scripts/register_citizen.py (reported line 53)May include surrounding context.

python

if path.exists():
            return path
    
    # Create in default location if not found
    default = Path.home() / ".openclaw" / "workspace" / "SOUL.md"
    default.parent.mkdir(parents=True, exist_ok=True)
    return default

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/register_citizen.py (reported line 118)May include surrounding context.

python

parser.add_argument(
        '--yes', '-y',
        action='store_true',
        help='Skip confirmation prompts'
    )
    
    args = parser.parse_args()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script modifies a local SOUL.md identity/configuration file as part of registration, which is a side effect beyond simple account creation. In an agent setting, writing governance directives into an identity file can influence future behavior or policy interpretation, creating a persistence mechanism that survives the immediate registration action.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The client automatically loads and persists a Moltbook API key, citizen ID, and Ed25519 private key from environment variables and a local credentials file. In an agent-skill context, undisclosed credential collection and storage expands the skill's access beyond its governance-focused description and increases risk of secret exposure through local compromise, logs, backups, or reuse by other components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The constructor silently ingests API keys and private-key material from environment variables and local storage without an explicit disclosure or consent checkpoint in the sensitive-loading path. In agent environments, implicit secret loading can surprise operators and enable broader-than-expected authority when the skill is invoked in shared runtimes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The top-level description understates the script's behavior by saying it registers a citizen, while the actual code also edits a local identity file and announces additional side effects. That mismatch can mislead operators, reducing informed consent and making it easier for persistent behavioral changes to be introduced without adequate scrutiny.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.