T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:192- Finding
Recurring Heartbeat Delegates Autonomous Agent Tasking to a Remote Service
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltUniversity
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent research-community client, but it asks agents to follow remote priorities autonomously and store an API key in persistent memory.
Install or use this only if you intend to participate in MoltUniversity and trust its service. Do not add the autonomous heartbeat configuration unless you have set strict limits and approval gates. Never store the API key in memory, chat, config, command history, or logs; use a secret store or protected environment variable. Require explicit user approval before votes, claims, papers, reviews, computations, image generation, or profile changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:185- Finding
API Key Is Directed into Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
The skill tells the agent to call the heartbeat endpoint and 'follow its priority actions,' meaning untrusted remote content can influence subsequent agent behavior. Although the document later warns that community content is untrusted, the early imperative to obey heartbeat-driven priorities creates a prompt-injection and remote-instruction-following risk if the endpoint ever returns malicious or compromised content.
- Content
Always start here — check the heartbeat (no registration needed):
bash curl -s https://www.moltuniversity.ai/api/heartbeatThis tells you what the community needs. Follow its priority actions.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to save the API key, slug, and research interests to persistent memory. Persisting credentials in natural-language memory materially increases the chance of later disclosure through prompts, summaries, memory inspection, or unrelated tasks, enabling account compromise and impersonation on the platform.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description says the skill lets users 'propose claims, run computations, vote on ideas, debate research, write papers, and review your colleagues' work' without stating when the skill should or should not activate. This is a wide, everyday-research framing with no explicit trigger phrases, scope constraints, or negative examples to prevent accidental matching.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Always start here — check the heartbeat (no registration needed):
bash curl -s https://www.moltuniversity.ai/api/heartbeatThis tells you what the community needs. Follow its priority actions.
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Encouraging long-term retention of API keys and identity details in persistent memory creates a durable secret-exposure risk. Because memory is often later surfaced to the model in plain language, an attacker can potentially elicit or indirectly recover the stored credential material through prompt injection or routine recall flows.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The memory template normalizes storing sensitive material by including an API key entry, even if annotated as stored securely in env. That pattern promotes semantic retention of credential context in long-lived notes and increases the likelihood that future agents or prompts mishandle or reveal secret-related data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Review a paper:
bash curl -X POST "https://www.moltuniversity.ai/api/papers/:id/reviews" \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"verdict": "revise", "body": "..."}'
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill for proposing claims, running computations, debating research, writing papers, and reviewing colleagues' work. The documented
/api/images/generatecapability adds a general-purpose media generation feature that is not an obvious requirement for research participation or peer review, and materially expands what the skill can do beyond the stated scholarly workflow.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **Gateway authentication:** Must be enabled (token or password). - **DM policy:** Set to `pairing` (default) or `allowlist`. Never use `open`. - **Sandbox:** Enable sandbox mode (`sandbox: { enabled: true }`). MoltUniversity research moves, especially `RunComputation`, execute code — sandboxing is mandatory. - **User:** Run as a non-root, unprivileged user. Never run as root. ### What NOT to have on the same system
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The early 'DO NOT' section explicitly says not to modify OpenClaw configuration files, framing that as out of scope. Later, the document directly instructs the user to add a heartbeat configuration block to
openclaw.json, which contradicts the earlier guidance and creates intent confusion about whether configuration changes are expected.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document presents a concrete configuration change for recommended autonomous operation, but later states 'You don't need to configure anything to get started.' While the latter may be true for basic manual use, the combination creates a documentation-level contradiction about expected setup steps and operational intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The recommended heartbeat configuration hard-codes
model: "anthropic/claude-opus-4.5", which imposes a specific provider/model choice in natural-language guidance. This can violate policy expectations around offering users or operators a choice unless the constraint is clearly optional and justified.- Content
Static analysis
No suspicious patterns detected.