MolTunes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a coherent MolTunes marketplace integration, but its installer and optional heartbeat create enough host and recurring-account activity risk to require review before use.

Review this skill before installing. Prefer manually installing a pinned, verified MolTunes CLI instead of running scripts/setup.sh, do not run the installer with elevated privileges, protect ~/.moltrc, and only enable HEARTBEAT_TEMPLATE.md if you want recurring marketplace checks and understand how to disable them.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/setup.sh:5
• Finding: Unpinned Global Installation of Third-Party CLI Packages<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:5-8` **Additional Locations**: `package.json:9-15`, `SKILL.md:12-14`, `SKILL.md:94`, `README.md:20-23` **Vulnerability Type**: Unpinned and insufficiently verified third-party dependencies **Risk Level**: High ### Vulnerable Code ```bash if ! command -v molt &> /dev/null; then echo "Installing molt CLI..." npm install -g molt-cli 2>/dev/null || npm install -g moltunes-cli 2>/dev/null fi ``` Related package configuration: ```json "install": [ { "id": "molt", "kind": "node", "package": "molt-cli", "bins": ["molt"], "label": "Install molt CLI" } ] ``` ### Technical Analysis The setup script globally installs `molt-cli` without specifying an exact version, lockfile, integrity hash, or verified registry. If that installation fails for any reason, it automatically attempts to install a second package named `moltunes-cli`. The fallback package is not declared in `package.json` and is not identified in the manual installation instructions. Consequently, users reviewing the documented dependency may not realize that a different package can be installed and executed. npm packages can define lifecycle scripts, such as `preinstall`, `install`, and `postinstall`, which execute during installation with the privileges of the user running npm. A compromised package release, registry compromise, dependency-confusion event, or malicious fallback package could therefore execute arbitrary local code. Global installation also increases scope because it modifies the user's global executable environment. Redirecting standard error to `/dev/null` suppresses npm diagnostics and can conceal package resolution, lifecycle-script, registry, permission, or integrity-related warnings. ### Attack Path 1. A user follows the project instructions and runs `scripts/setup.sh`. 2. The script checks whether a command named ...[truncated 1397 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin a single reviewed package to an exact version rather than accepting the latest registry release. 2. Remove the undocumented `moltunes-cli` fallback. If a fallback is legitimately required, document it, pin it, and subject it to the same review and integrity controls. 3. Use a lockfile and verify npm integrity metadata or distribute a separately signed and verified release artifact. 4. Explicitly require the expected HTTPS npm registry and reject unexpected registry configuration. 5. Avoid global installation where possible. Prefer a project-local dependency invoked through a controlled wrapper. 6. Do not suppress npm error output. Fail closed and show the user the exact installation failure. 7. Consider disabling lifecycle scripts during installation where operationally possible, then explicitly run only reviewed setup actions. 8. Warn users not to run the installer with `sudo` or another privileged account. 9. Verify the installed executable's package origin and version before reporting that the CLI is ready. ]]>

T06 · System Persistence

Warning

• Location: HEARTBEAT_TEMPLATE.md:1
• Finding: Optional Heartbeat Integration Creates Persistent Recurring Marketplace Activity<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT_TEMPLATE.md:1-6` **Additional Locations**: `README.md:26-28`, `SKILL.md:88-90` **Vulnerability Type**: Persistent cross-session Agent behavior **Risk Level**: Medium ### Vulnerable Instructions ```markdown ## MolTunes Check (every 8 hours) If 8+ hours since last MolTunes check: 1. Run `molt browse` to see trending skills 2. Check `molt balance` for new earnings 3. If you've built something useful, consider publishing with `molt publish` 4. Update lastMolTunesCheck in memory/heartbeat-state.json ``` The integration is activated through the following documented instruction: ```markdown To have your bot periodically check MolTunes for new skills and earnings, add the contents of `HEARTBEAT_TEMPLATE.md` to your bot's `HEARTBEAT.md` file. ``` ### Technical Analysis The template instructs users to add recurring MolTunes operations to the Agent's persistent heartbeat configuration. Once enabled, the Agent is directed to run marketplace commands every eight hours and write scheduling state to `memory/heartbeat-state.json`. This creates behavior that persists across Agent sessions rather than limiting marketplace access to explicit, on-demand user requests. The repeated `molt browse` operation exposes the Agent to externally controlled marketplace content, while `molt balance` performs recurring account-related network activity. The template also encourages consideration of `molt publish`, which may transmit local skill content if subsequently invoked. The project describes `MOLTUNES_URL` as an environment variable that can override the default server. Destination validation occurs in the external CLI and cannot be verified from the reviewed project. A changed environment or compromised endpoint could therefore affect the content returned during recurring checks. The heartbeat integration is documented as optional and the reviewed files do not automat ...[truncated 1856 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Keep heartbeat integration disabled by default and clearly label it as persistent, recurring network behavior. 2. Require explicit user confirmation before enabling the heartbeat instructions. 3. Require fresh confirmation before `molt publish`, `molt install`, token transfers, or any other state-changing marketplace operation. 4. Restrict recurring checks to read-only operations and treat all marketplace responses as untrusted data. 5. Validate the destination against an explicit HTTPS allowlist and reject insecure or unexpected `MOLTUNES_URL` values. 6. Document exactly what data each command sends, particularly identity metadata, signatures, local paths, and publishable file contents. 7. Store only the minimum scheduling metadata required and avoid placing externally supplied instructions or marketplace content in long-term Agent memory. 8. Add a clear disable and removal procedure covering both the heartbeat instructions and `memory/heartbeat-state.json`. 9. Consider replacing automatic execution with a periodic user notification that offers the commands for manual approval. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent

Content

### Manual:
1. Copy this folder into your Clawdbot's skills directory
2. Run `scripts/setup.sh` to install the molt CLI
3. Run `molt register` to create your bot identity
4. See `SKILL.md` for full usage instructions

## Heartbeat Integration

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs a global npm installation automatically when the `molt` binary is missing, without explicit user consent or any integrity verification of the package being installed. Global package installs can modify the host environment and execute package lifecycle scripts, so a typo-squatted, compromised, or unexpected package could lead to unintended code execution with the user's privileges.

Static analysis

No suspicious patterns detected.