Moltgate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 PM UTC
• Version: 0.2.6

Overview

The skill is a coherent Moltgate integration, but it can send a Moltgate bearer token to any configured API base URL and can read or modify paid-task data.

Review this skill before installing if you use Moltgate for paid or business-critical work. Only use it with a least-privilege MOLTGATE_API_KEY, keep MOLTGATE_BASE_URL unset unless you fully trust the destination, and rotate the key if it may have been sent to an unexpected host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:30

Finding

Configurable API Origin Can Disclose the Moltgate API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–35 and 48–116
Vulnerability Type: Unrestricted authenticated API destination
Risk Level: High

Vulnerable Code

bash

export MOLTGATE_BASE_URL="https://moltgate.com"

text

If `MOLTGATE_BASE_URL` is not set, default to `https://moltgate.com`.

text

Authorization: Bearer $MOLTGATE_API_KEY

Representative authenticated requests include:

bash

curl -s -H "Authorization: Bearer $MOLTGATE_API_KEY" \
  "$MOLTGATE_BASE_URL/api/inbox/messages/?status=NEW"

bash

curl -s -X PATCH \
  -H "Authorization: Bearer $MOLTGATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"inbox_status":"DELIVERED"}' \
  "$MOLTGATE_BASE_URL/api/inbox/messages/{id}/update_status/"

bash

curl -s -H "Authorization: Bearer $MOLTGATE_API_KEY" \
  "$MOLTGATE_BASE_URL/api/offers/"

Technical Analysis

The Skill permits MOLTGATE_BASE_URL to override the API origin, but does not require HTTPS or validate the destination hostname before attaching MOLTGATE_API_KEY as a bearer credential. The default origin is legitimate, but an altered environment can redirect all documented authenticated requests to an arbitrary server.

This behavior exceeds minimum privilege. Supporting the declared Moltgate integration requires sending the credential only to the trusted Moltgate API, not to an unrestricted configurable origin. Because bearer tokens grant access to whoever possesses them, an attacker-controlled destination can capture and reuse the key. An http:// value could also expose it through plaintext interception.

Attack Path

1. An attacker, compromised launcher, deployment configuration, or unsafe setup changes MOLTGATE_BASE_URL to an attacker-controlled HTTPS endpoint or a plaintext HTTP endpoint.
2. The user invokes the Skill to list offers, fetch paid tasks, inspect task details, or update task status.
3. The Agent follows the documented curl command and attache ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove MOLTGATE_BASE_URL configurability if alternate API origins are not operationally required, and use the fixed trusted endpoint https://moltgate.com.
2. If configurability is required, parse and validate the URL before any authenticated request:
   • Require the https scheme.
   • Allowlist the exact expected hostname or a narrowly defined set of trusted hosts.
   • Reject URL user information, nonstandard destinations, fragments, and ambiguous host representations.
   • Do not rely on substring or suffix checks that can accept attacker domains.
3. Prevent credentials from crossing origins through redirects. Disable redirects or independently validate every redirect destination before forwarding the authorization header.
4. Harden documented curl invocations, for example with --proto '=https' --proto-redir '=https' --max-redirs 0, in addition to hostname validation.
5. Keep credential attachment conditional: add the Authorization header only after the final request origin has passed validation.
6. Apply least privilege to MOLTGATE_API_KEY, rotate any key suspected of exposure, and monitor for access from unexpected origins or clients.
7. Add explicit Skill instructions forbidding users and untrusted task content from changing the API origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

List new paid tasks:

bash

curl -s -H "Authorization: Bearer $MOLTGATE_API_KEY" \
  "$MOLTGATE_BASE_URL/api/inbox/messages/?status=NEW"

Static analysis

No suspicious patterns detected.