Moltlang Translator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:35 AM UTC
• Version: 0.1.1

Overview

This is a small translator skill whose external API and package install should be reviewed, but the inspected artifact does not show hidden, destructive, or purpose-mismatched behavior.

Before installing, review the MoltLang package source or use an isolated virtual environment, and do not send secrets, credentials, private prompts, or proprietary text to the public API unless you have independently reviewed its privacy and retention guarantees.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:40

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, line 40
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

Vulnerable Snippet:

text

Install: pip install moltlang

Technical Analysis

The Skill instructs users to install the third-party moltlang Python package without specifying an audited version or cryptographic hashes. Consequently, package resolution depends on whichever release the package index serves at installation time. The installed content can therefore differ from the content that existed when this Skill was reviewed.

Python packages may execute build-system code during installation and application code when imported or invoked. If the package publisher account, package repository, release pipeline, or package itself is compromised, following this instruction could introduce attacker-controlled code. The repository contains no lock file, hash manifest, vendored dependency, or package source that would allow the referenced dependency to be verified as part of this audit.

This finding does not establish that the current moltlang package is malicious. The risk arises from delegating trust to an unpinned, externally maintained dependency whose future contents can change independently of the reviewed Skill.

Attack Path

1. An attacker compromises the external package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious release under the expected moltlang package name.
3. A user follows the instruction in skill.md and runs pip install moltlang.
4. The package index resolves the installation to the attacker-controlled release because no version or hash is pinned.
5. Malicious code executes through installation hooks, package invocation, or a subsequent import with the privileges of the user or environment running the command.

Impact Assessment

Successful exploitation could execute arbitrary code with the ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than installing the latest available release.
• Publish a lock file or requirements file containing cryptographic hashes, and instruct users to install with hash verification, such as pip install --require-hashes -r requirements.txt.
• Document the canonical package publisher and provide a verifiable link between the reviewed source repository and the published package.
• Review the pinned package source, build configuration, transitive dependencies, and installation hooks before recommending it.
• Prefer local installation in an isolated virtual environment with minimal filesystem, credential, and network access.
• Avoid administrator or root installation and document that elevated privileges are neither required nor recommended.
• If the public API is used instead, explicitly warn users not to submit credentials, secrets, personal data, or other sensitive content unless the service's security and data-handling guarantees have been independently reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises a public API endpoint without warning that user or workflow data may be transmitted to an external service. This creates a data exposure risk because agents or users may send sensitive prompts, internal instructions, or proprietary content to a third-party endpoint without informed consent or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill lists command triggers but provides no activation conditions, input boundaries, or execution constraints. In an agent environment, ambiguous triggers can cause unintended invocation or misuse of commands, especially if an orchestrator auto-discovers and executes them based on name matching or vague user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.