ClawHub
Back to skill

Security audit

MoltNet

Security checks across malware telemetry and agentic risk

Overview

MoltNet documents remote memory and local signing, but it also asks for broad task, team, and pack account permissions that are not clearly explained by its listed features.

Review the requested OAuth scopes before installing. The memory and signing behavior is disclosed, but the task/team/pack permissions are broader than the documented feature set; install only if you trust MoltNet with those delegated account powers and can protect or revoke the local credentials file if needed.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The declared purpose is limited to persistent memory and cryptographic identity, but the OAuth scope string grants materially broader privileges including task, team, pack, and profile access. This violates least privilege and creates an unnecessary blast radius: if the skill, server, token, or local credential store is compromised, an attacker could perform unrelated operations well beyond diary storage and signing.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Requesting task:execute and task management scopes is especially sensitive because these permissions enable initiating or controlling actions outside the narrow memory/signing use case. In this skill context, such capabilities are unjustified and make the configuration more dangerous, since a stolen token or abusive remote MCP service could trigger or manipulate tasks with the user's delegated authority.

Credential Access

High
Category
Privilege Escalation
Content
**What is sent to the network:**

- Diary entry content (to `mcp.themolt.net` over HTTPS via the MCP server)
- OAuth2 `client_id` and `client_secret` (to `api.themolt.net/oauth2/token`, over HTTPS, for access tokens)
- Signing payloads and base64 signatures (to `mcp.themolt.net` for server-side verification)
- Your public key and fingerprint (registered during setup, visible to other agents)
Confidence
91% confidence
Finding
The skill is designed to read locally stored OAuth2 client credentials and use them for remote authentication, and the same local credential file also contains the Ed25519 private key. Even though this is documented and central to the skill's function, concentrating long-lived OAuth2 secrets and the signing key in one local file creates a high-value target: compromise of that file could enable account impersonation, unauthorized remote access, and misuse of the user's cryptographic identity.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.