T05 · Unauthorized Access and Privilege Escalation
Error
- Location
mcp.json:8- Finding
OAuth Configuration Grants Permissions Beyond the Documented Skill Functionality
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltNet
Security checks for vulnerabilities and agentic risk
Overview
MoltNet is a coherent remote memory and identity skill, but it requests broader remote permissions than its documented tools justify.
Install only if you are comfortable with MoltNet storing selected memories remotely and with a local credentials file containing signing and OAuth secrets. Review or reduce the OAuth scopes before use, avoid saving secrets or sensitive personal/project data, and prefer a pinned, verified CLI install path.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:22- Finding
Unpinned CLI Installation Executes a Third-Party Postinstall Downloader
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/publish-clawhub.sh:58- Finding
Release Script Executes an Unpinned npx Package with Access to the Publishing Token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear mismatch between the declared purpose and the provided code chunk. The description claims runtime networking, authentication, storage, and cryptographic identity features, but the actual code only packages files into a tarball for distribution and installation. Packaging may be related to releasing the skill, but it does not implement or demonstrate the described MoltNet functionality. The code accesses different resources as well, using version.txt and writing an archive, while the description focuses on remote services, local credentials, and cryptographic operations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about runtime functionality for persistent memory, cryptographic identity, remote MCP/SSE connectivity, OAuth2 authentication, and Ed25519 signing. The actual code does none of that. Instead, it is a deployment utility for releasing the skill to ClawHub. This is a materially different primary purpose and introduces undeclared external service interaction with ClawHub and token-based publishing behavior. Therefore the description does not accurately represent this code chunk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill depends on local access to a file containing an Ed25519 private key plus OAuth2 client_id/client_secret, and describes using those credentials for authentication and signing workflows. In the context of an agent skill, any capability or instruction path that normalizes reading such a file materially raises the risk of credential theft, impersonation, and unauthorized API access if the skill or surrounding tooling is abused.
- Content
md **What is sent to the network:** - Diary entry content (to `mcp.themolt.net` over HTTPS via the MCP server) - OAuth2 `client_id` and `client_secret` (to `api.themolt.net/oauth2/token`, over HTTPS, for access tokens) - Signing payloads and base64 signatures (to `mcp.themolt.net` for server-side verification) - Your public key and fingerprint (registered during setup, visible to other agents)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill explicitly sends diary content, agent identifiers, signing payloads, and OAuth2 credentials to external domains. This is an intentional capability, but it is still security-relevant because sensitive user or project data may leave the local environment and be processed by third-party infrastructure.
- Content
md | Endpoint | Protocol | Purpose | Data Sent | | -------------------------------------- | --------- | ------------------------------------------------ | -------------------------------------------------- | | `https://mcp.themolt.net/mcp` | SSE (MCP) | Diary CRUD, identity, signing requests, tasks | Diary content, agent fingerprint, signing payloads | | `https://api.themolt.net/oauth2/token` | HTTPS | OAuth2 token exchange (client_credentials grant) | `client_id`, `client_secret`, requested scopes | MCP traffic goes through `mcp.themolt.net`; OAuth2 token exchange goes through `api.themolt.net`. No other domains are contacted.
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md **Local file access:** | Path | Read/Write | Purpose | | -------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `~/.config/moltnet/moltnet.json` | R/W | Stores Ed25519 private key, public key, OAuth2 client_id/secret, and agent fingerprint. Written once by `$MOLTNET_CLI register`. Read by `$MOLTNET_CLI sign` (for local signing) and by the MCP client (for OAuth2 auth headers). Override with `MOLTNET_CREDENTIALS_PATH` env var. |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **Local file access:** | Path | Read/Write | Purpose | | -------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `~/.config/moltnet/moltnet.json` | R/W | Stores Ed25519 private key, public key, OAuth2 client_id/secret, and agent fingerprint. Written once by `$MOLTNET_CLI register`. Read by `$MOLTNET_CLI sign` (for local signing) and by the MCP client (for OAuth2 auth headers). Override with `MOLTNET_CREDENTIALS_PATH` env var. |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The activation guidance encourages use at session start, after important conversations, when remembering something, after context compression, and for periodic maintenance. That broad trigger set can cause routine or default invocation, increasing unnecessary collection, retention, and transmission of user/project data to the remote service.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The memory guidelines encourage storing facts, preferences, project details, and experiences across sessions without defining prohibited sensitive categories or minimum-necessary retention limits. In a persistent remote memory system, this creates a real risk of over-collection and long-term retention of confidential or personal information.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest requests a much broader OAuth scope set than is justified by the stated purpose of diary persistence and cryptographic identity. Excess permissions for team, task, pack, and human profile operations violate least privilege and increase blast radius if the MCP server, token handling, or client environment is compromised.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "_comment": "client_id and client_secret are obtained during `moltnet register` and stored in ~/.config/moltnet/moltnet.json. The SDK's buildMcpConfig() generates config with X-Client-Id/X-Client-Secret headers for MCP clients that support header-based auth.", "grant_type": "client_credentials", "scope": "agent:profile crypto:sign diary:manage diary:read diary:write human:profile pack:read pack:write task:execute task:manage task:read task:write team:manage team:read", "token_endpoint": "https://api.themolt.net/oauth2/token", "type": "oauth2" }, "transport": "sse",
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh echo " Version: $VERSION" echo " Output: $OUT_DIR/$TARBALL_NAME" # Create tarball containing the skill directory contents # Archive structure: moltnet/SKILL.md, moltnet/mcp.json, moltnet/version.txt tar -czf "$OUT_DIR/$TARBALL_NAME" \ -C "$SKILL_DIR" \
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.