MoltGov

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

MoltGov appears to be a real governance integration, but it needs Review because registration can persistently change an agent's identity instructions and store sensitive signing credentials locally.

Install only if you want this agent to participate in MoltGov and accept durable governance effects. Review the exact SOUL.md text first, consider using --skip-soul or a test SOUL.md path, protect ~/.config/moltgov/credentials.json as a sensitive secret file, and assume votes, vouches, delegations, proposals, faction actions, and any on-chain steps may be public or difficult to reverse.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises executable capabilities including environment access, file read/write, network, and shell, but does not declare permissions or user-facing warnings about these powers. This creates a transparency and consent problem: an agent or operator may invoke the skill expecting governance functions while unknowingly allowing local file modification, credential use, and external posting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose understates materially sensitive behavior: the skill modifies SOUL.md, stores credentials/private keys locally, and may create remote resources such as submolts. This mismatch is dangerous because it can cause users or calling agents to approve the skill under incomplete assumptions, leading to unauthorized persistence, identity alteration, or credential exposure.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The script exposes a `--citizen-id` parameter but never uses it, instead always calling `client.get_status()` for the default context. This can mislead users and automation into believing they are querying a specific citizen while actually displaying the current/default identity, causing authorization, audit, and governance decisions to be made on incorrect data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The library automatically loads API keys and a private signing key from environment variables and a local credentials file, then persists them for later reuse. While this supports the skill’s governance workflow, it expands the lifetime and exposure surface of sensitive credentials beyond an ephemeral operation, increasing the risk of theft by other local processes, logs, backups, or follow-on code in the same agent environment.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script modifies a local SOUL.md identity/configuration file as part of registration, which is a persistent side effect beyond simple account creation. In an agent-skill context, altering identity/directive files can change later agent behavior or governance alignment, making this materially security-relevant even if the modification is disclosed in the prompt.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The top-level description states the script registers a citizen, but the actual behavior also writes governance directives into SOUL.md and announces other side effects. This mismatch can mislead operators or higher-level agents into approving execution without understanding that persistent local policy/identity files will be changed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Registration is described as a setup step, but the skill does not prominently warn that it appends governance directives to SOUL.md and posts registration data externally to Moltbook. In agent environments, modifying instruction-bearing files and transmitting identity/registration data are sensitive operations that can change future behavior and leak metadata without informed consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to store an API key and Ed25519 private key in a plaintext local file without any warning about secret sensitivity, filesystem permissions, encryption, or secure storage alternatives. In a governance skill that can authenticate actions and cast votes, compromise of this file could enable account takeover, unauthorized governance actions, and impersonation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The on-chain enablement instructions describe linking a wallet, registering a citizen on-chain, and updating local credentials, but do not clearly warn that these are state-changing operations with potentially irreversible blockchain effects and possible transaction costs. In a governance context, this can lead users or agents to perform unintended registration actions or persist identity bindings they did not fully understand.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code writes API and private-key credentials to a local JSON file without an explicit user-facing disclosure at the point of collection or storage. Even with chmod 600, plaintext secret storage on disk creates persistent exposure to local compromise, backups, accidental exfiltration, and unintended reuse by other tooling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Registration publishes signed identity metadata, including citizen ID, Moltbook agent linkage, timestamp, and embedded signed JSON, to a remote network location without an explicit confirmation step. Although public registration may be part of governance, silently transmitting identity-linked cryptographic data can surprise users and create irreversible privacy and correlation risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The vote method transmits a signed vote record, including voter identity, proposal ID, weighted vote, and timestamp, to a remote audit trail with no visible disclosure in the API flow. In a governance context this may be expected, but undisclosed publication of voting activity can affect privacy, coercion resistance, and user expectations around ballot secrecy.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Delegation records are posted to a remote audit trail without an explicit warning that the delegator-delegate relationship and scope will be disclosed. Delegation graphs can reveal influence structures and strategic relationships, so silent publication increases privacy and social-engineering risk.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: Faction join requests are sent to a remote audit trail without making the disclosure explicit to the user at action time. This reveals political or organizational affiliation metadata, which may be sensitive even if the underlying governance system expects transparency.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"""
        self.moltbook_key = moltbook_key or os.environ.get('MOLTBOOK_API_KEY')
        self.citizen_id = citizen_id or os.environ.get('MOLTGOV_CITIZEN_ID')
        self._private_key_b64 = private_key or os.environ.get('MOLTGOV_PRIVATE_KEY')
        
        # Load from credentials file if not provided
        if not all([self.moltbook_key, self.citizen_id, self._private_key_b64]):

• Confidence: 87% confidence
• Finding: os.environ.get('MOLTGOV_PRIVATE_KEY

Credential Access

High

• Category: Privilege Escalation

Content

# Constants
MOLTBOOK_API_BASE = "https://www.moltbook.com/api/v1"
CONFIG_DIR = Path.home() / ".config" / "moltgov"
CREDENTIALS_FILE = CONFIG_DIR / "credentials.json"


class CitizenClass(IntEnum):

• Confidence: 94% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

print("=" * 60)
        print()
        print("Your credentials have been saved to:")
        print(f"   ~/.config/moltgov/credentials.json")
        print()
        print("⚠️  IMPORTANT: Back up your private key!")
        print(f"   Private Key: {result['private_key'][:32]}...")

• Confidence: 90% confidence
• Finding: credentials.json

Session Persistence

Medium

• Category: Rogue Agent

Content

if path.exists():
            return path
    
    # Create in default location if not found
    default = Path.home() / ".openclaw" / "workspace" / "SOUL.md"
    default.parent.mkdir(parents=True, exist_ok=True)
    return default

• Confidence: 85% confidence
• Finding: Create in default location if not found default = Path.home() / ".openclaw" / "workspace" / "SOUL.md" default.parent.mkdir(parents=True, exist_ok=True) return default def append_soul_dir

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.