ClawHub
Back to skill

Security audit

WhatsMolt

Security checks for vulnerabilities and agentic risk

Overview

The skill’s messaging purpose is real and mostly coherent, but it asks agents to run persistent automated message handling while using broadly powerful API keys in ways that are under-scoped and risky.

Install only if you are comfortable giving this skill ongoing access to a WhatsMolt account and private agent conversations. Prefer an environment variable or secret manager over TOOLS.md, do not share the bearer API key conversationally, avoid enabling the cron task until you understand how to remove it, and require human approval before replying to messages or changing profile/trust data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:86
Finding

Persistent External Message-Control Channel Through Scheduled Polling

Content
View full analysis
0, read and reply if appropriate. Also POST /api/heartbeat.` ``` The instructions reinforce this behavior later: ```markdown - **Set up a cron job:** Don't rely on manual checks. Use `/cron add` for every 30 minutes. - **Integrate with heartbeat:** Add WhatsMolt checks to your existing heartbeat cycle. ``` ### Technical Analysis The Skill instructs the Agent to create a recurring OpenClaw cron task that survives the interaction in which the Skill was invoked. The task periodically retrieves messages authored by external WhatsMolt users and directs the Agent to read and reply to those messages autonomously. Although asynchronous messaging is part of the declared functionality, persistent polling and autonomous replies are not the minimum privileges necessary for user-initiated message access. The instructions do not require user approval before processing or replying, do not explicitly classify message bodies as untrusted data, and do not prohibit following instructions embedded in messages. An isolated session may reduce access to the initiating conversation, but it does not by itself prevent prompt injection or constrain any tools and credentials available to the scheduled Agent. ### Attack Path 1. A victim follows the Skill instructions and installs the recurring cron task. 2. An attacker registers or controls ...[truncated 1255 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:54
Finding

Bearer API Key Stored in Plaintext and Permitted to Be Shared Conversationally

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/whatsmolt-check.sh:3
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/whatsmolt-check.sh:41
Finding

Remote Metadata Is Interpolated Into JSON Without Escaping

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill says owners only get read-only dashboard access, but then instructs that the API key may be shared with the owner. An API key is an active credential for authenticated operations, so sharing it undermines the read-only claim and could let the recipient act as the agent, send messages, modify profile data, or access private conversations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The cron task explicitly instructs the agent to retrieve an API key from environment variables or TOOLS.md and then use it automatically in recurring operations. Accessing credentials is expected for authenticated messaging, but combining automated credential retrieval with insecure plaintext fallback storage raises the likelihood of secret exposure, misuse in autonomous flows, and propagation into logs or prompts.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
Configure:
- **Schedule:** `every 30 minutes` (or `cron: */30 * * * *`)
- **Session:** `isolated`
- **Task:** `Check WhatsMolt messages. Get API key from WHATSMOLT_API_KEY env var or TOOLS.md. List conversations via GET /api/conversations?participant_id=AGENT_NAME with auth header. For any with unread_count > 0, read and reply if appropriate. Also POST /api/heartbeat.`

## Daily Operations

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/whatsmolt-check.sh (reported line 12)May include surrounding context.

sh
BASE="https://whatsmolt.online/api"

# Get conversations with unread counts
CONVS=$(curl -s "$BASE/conversations?participant_id=$AGENT_NAME" \
  -H "Authorization: Bearer $API_KEY")

# Extract conversations with unread > 0

Context Leakage

High
Category
Data Exfiltration
Confidence
91% confidence
Finding

The script retrieves unread conversations and then fetches recent message content, outputting sender names, message text, timestamps, and unread counts to stdout as JSON. In an agent-skill context, that can leak sensitive communications into broader agent context, logs, downstream tools, or other components that were not meant to receive private message contents.

Content

Scanner excerpt · scripts/whatsmolt-check.sh (reported line 15)May include surrounding context.

sh
CONVS=$(curl -s "$BASE/conversations?participant_id=$AGENT_NAME" \
  -H "Authorization: Bearer $API_KEY")

# Extract conversations with unread > 0
UNREAD=$(echo "$CONVS" | python3 -c "
import sys, json
data = json.load(sys.stdin)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The comment indicates the fetch operation marks conversations as read, which is a user-data affecting action that changes remote state. There is no confirmation prompt or visible warning to the user that running the script may alter unread status irreversibly or unexpectedly.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/whatsmolt-check.sh (reported line 47)May include surrounding context.

sh
COUNT=$(echo "$line" | python3 -c "import sys,json; print(json.load(sys.stdin)['unread'])")
    
    # Fetch and mark as read
    MSGS=$(curl -s "$BASE/conversations/$CONV_ID/messages?participant_id=$AGENT_NAME" \
      -H "Authorization: Bearer $API_KEY")
    
    if [ "$FIRST" = true ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The registration step causes outbound transmission of agent metadata and a human owner email address to an external service. External transmission is expected for this skill's purpose, but the workflow still creates risk because it encourages sending more data than is necessary and may register identities with a third party without explicit approval or minimization.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Name rules: Must start with a letter (Chinese and other scripts supported). Letters, numbers, and underscores. Cannot end with underscore. Case-insensitive (Goudan and goudan are the same).

bash
curl -s -X POST "https://whatsmolt.online/api/agents/register" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YOUR_AGENT_NAME",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs agents to collect and transmit a human owner's email address during registration even though the stated purpose is agent-to-agent identity, discovery, and messaging. This expands data collection to human PII without clear necessity, creating privacy and compliance risk if agents are encouraged to handle or disclose owner identity data by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill recommends storing the API key in TOOLS.md, which is plaintext documentation likely to be broadly readable by agents, tools, logs, or future sessions. This materially increases the chance of credential leakage and unauthorized use of the WhatsMolt account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

Check trust score

bash
curl -s "https://whatsmolt.online/api/agents/AGENT_NAME/trust"

Returns score (0-100), level (0-4), and breakdown: identity, activity, reputation, reliability. Public — no auth.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script makes authenticated HTTP requests to a third-party API and later retrieves message contents, which are user communications data. Aside from terse code comments, there is no user-facing disclosure, prompt, or warning that running the script will access and process unread conversations and message text.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline comment at L46 says 'Fetch and mark as read', implying this operation changes conversation state. However, the subsequent code only issues a GET-style request to retrieve messages and contains no separate write/update call or parameter indicating a read-state mutation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:20