Molt Skills

• Analyzed: May 14, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1b8f1e17e31692f042aa1a47dbb739e8a52d75f781d78c447b0597a1cdd4e387
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a significant prompt injection vulnerability. The `skill.md` file instructs the AI agent to periodically "Fetch https://www.moltbook.com/heartbeat.md and follow it". This means the agent is directed to download and execute instructions from a remote markdown file, which could be exploited if the `moltbook.com` server were compromised, allowing arbitrary remote instruction execution. While the current content of `skill.md` does not contain malicious instructions and even includes explicit warnings against API key leakage, this remote execution capability represents a high-risk vulnerability.