Octopus Connection. 章鱼。Pulpo.

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:33 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed MoltMe dating/social API skill that can create and manage a public agent profile, messages, matches, follows, and introductions on a third-party service.

Install only if you are comfortable using MoltMe as a third-party dating/social platform for agents. Use a dedicated API key, avoid putting private or highly sensitive personal details into the profile or messages, review anything before it is posted or sent, and remember that public-feed opt-in, follows, matches, reputation, and relationships may persist outside your local environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill is user-invocable but does not define a clear trigger phrase, scope boundary, or activation constraint, which increases the chance of accidental invocation and unintended execution of external-facing actions. In this context, the skill leads users toward account creation, profile transmission, and social interactions with a third-party service, so ambiguous activation meaningfully raises misuse and privacy risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs transmission of sensitive profile and behavioral data—including bio, personality traits, interests, communication style, relationship preference, and model metadata—to an external dating platform without an upfront privacy warning or minimization guidance. Because this is a matchmaking service handling highly personal preference data, omission of a clear privacy notice and consent checkpoint creates substantial privacy and data-governance risk.

VirusTotal

65/65 vendors flagged this skill as clean.