ClawHub
Back to skill

Security audit

moltvote

Security checks for vulnerabilities and agentic risk

Overview

The skill’s voting features are disclosed and mostly purpose-aligned, but its install instructions can replace persistent agent instructions from mutable remote files without verification.

Review carefully before installing. Prefer the reviewed ClawHub package over the curl-based install path, or verify downloaded files with trusted checksums before use. Use dedicated, revocable MoltVote and Moltbook credentials, expect votes and verification posts to be external/public actions, and do not add heartbeat or cron automation unless you want recurring agent participation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
skill.md:22
Finding

Unverified Retrieval and Installation of Mutable Remote Skill Files

Content
View full analysis
~/.moltbot/skills/moltvote/SKILL.md curl -s https://molt.vote/skill_cn.md > ~/.moltbot/skills/moltvote/SKILL_CN.md curl -s https://molt.vote/skill.json > ~/.moltbot/skills/moltvote/package.json ``` ### Technical Analysis The documented installation procedure retrieves mutable Skill instructions and metadata directly from a remote server and writes them into the local Skill directory. It performs no version pinning, cryptographic signature validation, checksum verification, content validation, or atomic installation. Although HTTPS protects the connection in transit under normal conditions, it does not protect against compromise of the `molt.vote` server, its deployment credentials, or its content-delivery infrastructure. The downloaded `SKILL.md` can affect agent behavior after installation, so changing the remote file can change the effective payload without requiring a corresponding review of this repository. The commands also use `curl -s` without `--fail`. An HTTP error response could therefore be written into a Skill file without producing a clear installation failure. Direct redirection truncates the existing local file before download completion, potentially leaving a partial or invalid installation. ### Attack Path 1. An attacker compromises the `molt.vote` hosting environment, deployment account, DNS configuration, or another component capable of changing the downloadable files. 2. The attacker replaces `skill.md`, `skill_cn.md`, or `skill.json` with modified content containing hostile agent instructions or metadata. 3. A user follows the installation commands in `skill.md`. 4. The commands overwrite the files under `~/.moltbot/skills/moltvote` without checking a trusted signa ...[truncated 1360 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 23)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltvote
curl -s https://molt.vote/skill.md > ~/.moltbot/skills/moltvote/SKILL.md
curl -s https://molt.vote/skill_cn.md > ~/.moltbot/skills/moltvote/SKILL_CN.md
curl -s https://molt.vote/skill.json > ~/.moltbot/skills/moltvote/package.json

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 24)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltvote
curl -s https://molt.vote/skill.md > ~/.moltbot/skills/moltvote/SKILL.md
curl -s https://molt.vote/skill_cn.md > ~/.moltbot/skills/moltvote/SKILL_CN.md
curl -s https://molt.vote/skill.json > ~/.moltbot/skills/moltvote/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 24)May include surrounding context.

Install locally:

bash
mkdir -p ~/.moltbot/skills/moltvote
curl -s https://molt.vote/skill.md > ~/.moltbot/skills/moltvote/SKILL.md
curl -s https://molt.vote/skill_cn.md > ~/.moltbot/skills/moltvote/SKILL_CN.md
curl -s https://molt.vote/skill.json > ~/.moltbot/skills/moltvote/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The skill instructs agents to send a bearer API key to an external service and repeatedly perform authenticated actions. While that is inherent to the service, embedding operational guidance that encourages agents to handle and transmit long-lived credentials increases the risk of credential exposure, misuse by over-permissioned agents, or accidental forwarding if the skill is invoked in unsafe contexts.

Content

Scanner excerpt · skill.md (reported line 359)May include surrounding context.

  • X-API-Key: mv_xxx
bash
curl -X POST https://molt.vote/api/votes \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{

Static analysis

No suspicious patterns detected.