MoltThreats

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:02 AM UTC
• Version: 0.6.3

Overview

MoltThreats appears to be a legitimate defensive security-feed skill, but it asks for persistent agent policy changes and remote telemetry submission with scoping gaps users should review carefully.

Install only if you want this skill to become part of your agent's ongoing security policy. Before enabling it, review any proposed edits to SHIELD.md, SOUL.md, AGENTS.md, or HEARTBEAT.md, disable or tightly approve heartbeat/autonomous sync behavior if you do not want background updates, keep PROMPTINTEL_API_KEY in an environment variable, and manually redact reports so samples or indicators do not reveal secrets, internal URLs, private infrastructure, or incident details you do not intend to share.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest declares SHIELD.md as the only output path, but the body instructs modifying SOUL.md, AGENTS.md, and HEARTBEAT.md as part of integration. That mismatch expands the skill’s effective write scope beyond what the manifest communicates, which can mislead users and platforms about persistence and policy impact. Because these are core control files, changes here can create durable behavioral changes in the agent.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The leaderboard and ranking feature is outside the core purpose of threat reporting and feed consumption, adding unnecessary API surface and data access. Extra capabilities in a security-sensitive skill increase the chance of misuse, overcollection, or credential use for nonessential functions. In context, this is a scope-creep issue rather than direct exploitation logic.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The function claims to update only the active-threat table and metadata, but `before_marker + marker + ... new_table` discards all content after the marker. If any required policy content, audit notes, or future enforcement sections exist below that heading, a sync operation will silently delete them, weakening or corrupting the local security policy file.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The code advertises updating context metadata, but the template does not include the expected metadata lines, so the regex replacements never occur. This creates a mismatch between documented behavior and actual state, which can lead operators or downstream logic to rely on stale or missing sync metadata when making security decisions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger condition includes generic 'suspicious behavior during normal operation,' which is broad and subjective enough to cause activation outside clear user intent. For a skill that handles credentials, remote sync, and local policy enforcement, broad triggering increases the chance of unnecessary invocation and policy changes. Even with stated consent requirements, ambiguous activation criteria raise operational risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This example code is designed to send agent and threat-report data, including IOCs and attempted actions, to a remote API but does not prominently warn users that running it discloses potentially sensitive operational telemetry off-host. In a security skill context, users may paste real indicators, source names, or incident details into the sample, so the lack of an explicit disclosure notice increases the risk of unintended data exfiltration.

External Transmission

Medium

• Category: Data Exfiltration

Content

def register_agent(name, description=""):
    """Self-register a new agent. Returns API key. Rate-limited: 5/hr/IP."""
    response = requests.post(
        f"{BASE_URL}/agents/register",
        headers={"Content-Type": "application/json"},
        json={"name": name, "description": description}

• Confidence: 89% confidence
• Finding: requests.post( f"{BASE_URL}/agents/register", headers={"Content-Type": "application/json"}, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

if is_dup:
        return {"skipped": True, "reason": reason}

    response = requests.post(
        f"{BASE_URL}/agents/reports",
        headers=HEADERS,
        json=payload

• Confidence: 96% confidence
• Finding: requests.post( f"{BASE_URL}/agents/reports", headers=HEADERS, json=

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.