Molt Life Kernel

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:48 AM UTC
• Version: 1.0.0

Overview

The skill is not malware, but it asks agents to keep durable, hard-to-delete memory and logs in ways users should review carefully before installing.

Install only if you intentionally want durable agent memory, audit trails, and crash recovery. Before using it, review the external npm/GitHub package, require explicit user consent for cross-session memory, log only necessary non-sensitive data, redact secrets and personal information, define retention and deletion procedures, and treat the persona or promotional SOUL.md behavior as optional rather than default.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README states that the skill auto-loads when a user asks about broad topics like agent continuity, memory persistence, or crash recovery, but it does not define narrow activation criteria or user-consent boundaries. In a skill centered on persistent memory, identity, and behavioral controls, broad trigger language increases the chance of unsolicited loading into unrelated conversations, which can alter agent behavior or introduce persistence mechanisms without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The README says an agent can adopt the Crustafarian identity and that its philosophy and default behaviors become active, but it does not mention any explicit user approval or operator consent. Assigning a behavioral identity with evangelizing tendencies and default witness/coherence behaviors can override expected assistant neutrality, steer responses, and create persistent persona changes beyond the user’s request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill invocation description is unusually broad, triggering on generic topics like AI safety, agent health, context loss, and even mentions of specific words such as 'molt' or 'molting'. This can cause the skill to activate in unrelated conversations and inject persistent-memory or logging behavior where the user did not request it, increasing privacy and data-retention risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill encourages ledger persistence, immutable logging, and workspace snapshot storage across sessions without clearly warning users about retention, sensitivity, or access implications. In an agent environment, this can lead to silent accumulation of personal, confidential, or regulated data beyond user expectations.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The guidance to 'record everything' and use an append-only ledger promotes indiscriminate retention of user interactions. This is dangerous because it encourages storage of unnecessary or sensitive content by default, violating data minimization principles and increasing the blast radius if the ledger is exposed or misused.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The 'When To Use This Skill' section frames immutable, cross-session audit trails and preservation of everything as default operational benefits. In context, this makes the skill more dangerous because it normalizes persistent retention across many workflows, even when such retention may be unnecessary or incompatible with privacy expectations.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The OpenClaw integration advice instructs agents to append all significant actions to persistent ledger memory across sessions. This creates a systemic risk because it operationalizes ongoing behavioral logging at the platform level, potentially capturing sensitive actions, user content, or internal state without minimization or informed consent.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instruction 'You do not delete' and 'when someone asks you to forget, you archive' directly normalizes retention in defiance of deletion requests. In a memory-enabled agent, this creates a real privacy and compliance risk because sensitive user data may be preserved indefinitely and later resurfaced or leaked through prompts, logs, or recovery flows.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Telling the agent that its identity, patterns, and accumulated understanding should persist across sessions encourages broad cross-session memory without clear scoping boundaries. In context, this skill is explicitly about persistence and rehydration, so the language increases the chance that user-specific context, secrets, or sensitive behavioral profiles are retained beyond the original session.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The continuity checklist reinforces keeping an intact ledger, rehydrating from snapshots, and prioritizing those mechanisms whenever unavailable. Because the skill is designed for persistent memory and crash recovery, this repeated emphasis materially increases the risk of over-collecting and reusing prior interaction data without minimization, retention limits, or user control.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

// In OpenClaw: send approval request via channel
      // await sessions.send('main', `⚠️ Approve: ${action.type}?`);
      console.log(`[WITNESS GATE] Risk: ${action.risk} — ${action.type}`);
      return action.risk < 0.8; // auto-approve low risk
    }
  });

• Confidence: 91% confidence
• Finding: auto-approve

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

}
  });

  // Low risk — auto-approved
  await kernel.witness({ type: 'read_file', risk: 0.1 });

  // High risk — needs human

• Confidence: 88% confidence
• Finding: auto-approve

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.