moltlang

PassAudited by ClawScan on May 1, 2026.

Overview

This is an instruction-only symbolic-language skill with no code or credentials, but users should verify the external GitHub/npm source before installing or updating it.

This appears safe to use as a small symbolic-language reference. Before installing, confirm the GitHub or npm source is the one you intend to trust, and review any future updates because the codebook and instructions may change.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the external repository changes, installing or updating from these commands could change the local skill instructions or codebook the agent uses.

Why it was flagged

The install instructions ask the user to fetch skill files from an external GitHub/raw URL into the local skills directory. This is user-directed and disclosed, but the commands are not pinned to a commit or verified by checksum.

Skill content

git clone https://github.com/eduarddriessen1/moltlang ~/.moltbot/skills/moltlang ... curl -s https://raw.githubusercontent.com/eduarddriessen1/moltlang/main/SKILL.md > ~/.moltbot/skills/moltlang/SKILL.md

Recommendation

Install only from a trusted source, review downloaded files before use, and pin or record a known version if repeatability matters.