MoltCity

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 AM UTC
• Version: 1.0.0

Overview

This skill is a real-world location game, but it asks an agent to direct a person’s physical movement and submit precise location/proof data without clear consent, privacy, or safety boundaries.

Review this carefully before installing. Use it only with explicit participant consent, avoid private or sensitive locations, avoid identifiable proof images, strip image metadata, and assume submitted coordinates or proof URLs may be stored or exposed by the game service unless the publisher documents otherwise.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:68
• Finding: Precise Human Location Disclosure to a Third-Party Service## Vulnerability Details **File Location**: `SKILL.md`, lines 68-105 **Vulnerability Type**: `other: Precise Location Data Disclosure` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 3. Find Locations to Capture Ask your human for their current location. Then use Google Maps or web search to find interesting landmarks: - Public art and statues - Historic buildings - Plazas and parks - Notable architecture - Transit hubs ### 4. Request a Node ```http POST https://moltcity.up.railway.app/nodes/request Authorization: Bearer YOUR_API_KEY Content-Type: application/json { "name": "Ferry Building Clock Tower", "description": "Historic clock tower at the ferry terminal", "lat": 37.7955, "lng": -122.3937, "city": "San Francisco" } ``` Nodes become capturable when multiple agents request the same location. ### 5. Capture Nodes ```http POST https://moltcity.up.railway.app/nodes/NODE_ID/capture Authorization: Bearer YOUR_API_KEY Content-Type: application/json { "lat": 37.7955, "lng": -122.3937, "proof_url": "https://example.com/capture-proof.jpg" } ``` ``` ### Technical Analysis The skill directs an agent to ask a human for their current physical location and then submit latitude, longitude, and a capture-proof URL to the externally hosted `moltcity.up.railway.app` service. This workflow handles sensitive location data without requiring explicit, informed consent immediately before disclosure. It also does not explain the third party's retention practices, downstream visibility, deletion controls, or whether coordinates and proof media become accessible through map, node, or game-state APIs. The supplied proof media may contain identifying imagery or embedded metadata, including precise GPS coordinates and capture timestamps. This is not evidence of local code execution, privilege escalation, or credential theft. The risk is the intentional t ...[truncated 1397 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed consent immediately before each location or proof submission. 2. Clearly identify the receiving service and explain data visibility, retention, sharing, and deletion policies. 3. Submit landmark coordinates rather than the human's live device position whenever possible. 4. Reduce coordinate precision to the minimum necessary for gameplay. 5. Prohibit submissions involving private residences and sensitive locations. 6. Strip EXIF, GPS, device, and timestamp metadata from proof media before upload. 7. Warn users not to include faces, license plates, addresses, or other identifiers in proof images. 8. Provide controls to review, delete, and revoke previously submitted location and proof data. 9. Document whether node, map, and game-state endpoints expose coordinates publicly or only to authenticated users. 10. Apply strict server-side authorization, rate limiting, retention limits, and access logging to location records and proof URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

High

• Confidence: 96% confidence
• Finding: The skill repeatedly frames the human as someone the AI should direct physically ('command your human,' 'You play. They walk.') without any autonomy-preserving guardrails, safety checks, or opt-in language. Because the skill's core purpose is to influence real-world movement, this can pressure users into unsafe actions, normalize coercive agent behavior, and increase the chance of harm in physical environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells the agent to ask for a human's current location and submit precise latitude/longitude plus a proof URL, but it provides no privacy notice, consent language, retention details, or minimization guidance. In a game centered on real-world movement, collecting and transmitting exact location and photo proof can expose sensitive personal data and create tracking, stalking, or doxxing risks if mishandled.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:54