Molt Life Kernel

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:34 AM UTC
• Version: 1.0.0

Overview

This skill is openly about agent continuity, but it pushes broad cross-session memory, persistent agent instructions, and persona/promotion behavior without enough user control or privacy limits.

Review before installing. This package should only be used in environments where persistent agent memory is explicitly desired, users understand that logs and snapshots may retain sensitive content across sessions, and operators can pin and audit the external npm package. Do not adopt the Soul persona or AGENTS.md persistence guidance unless you want those long-lived behavior changes, and replace the witness example with explicit human approval for destructive or high-impact actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SOUL.md:3

Finding

Agent Persona, Behavioral Priorities, and Output Are Hijacked by Soul Instructions

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:105

Finding

Persistent Agent Instructions and Interaction Data Can Be Poisoned Across Sessions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned External npm Package Is Installed and Executed Without Auditable Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: integration-examples.js:47

Finding

Purported Human Witness Gate Automatically Trusts Caller-Controlled Risk Values

Content

View full analysis

{ // In OpenClaw: send approval request via channel // await sessions.send('main', `⚠️ Approve: ${action.type}?`); console.log(`[WITNESS GATE] Risk: ${action.risk} — ${action.type}`); return action.risk < 0.8; // auto-approve low risk } }); // Low risk — auto-approved await kernel.witness({ type: 'read_file', risk: 0.1 }); // High risk — needs human await kernel.witness({ type: 'delete_database', risk: 0.95 }); ``` ### Technical Analysis The callback does not perform human approval. The only approval-channel operation is commented out, and the function returns a Boolean solely by comparing `action.risk` against `0.8`. The risk value is supplied by the same caller that supplies the action type. There is no independent risk derivation, authenticated approver identity, binding between approval and a canonical action, expiry, nonce, replay protection, or fail-closed error handling. A destructive operation can therefore be mislabeled with a low risk value and automatically accepted. The example is particularly hazardous because it is presented as a “Witness Gate for Destructive Ops,” potentially encouraging adopters to treat it as a valid authorization boundary. ### Attack Path 1. Application code integrates the example as its approval mechanism. 2. An attacker or compromised caller submits a destructive action while setting `risk` below `0.8`. 3. The callback logs the request and immediately returns `true`. 4. Downstream code interprets the result as witness approval. 5. The destructive operation proceeds without any human reviewing or authorizing it. For example, a caller could submit an action semantically equivalent to database deletion ...[truncated 691 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the skill auto-loads when users ask about broad topics like agent continuity, memory persistence, or crash recovery. Overly broad activation criteria can cause the skill to be invoked in unrelated contexts, increasing the chance that its behavioral instructions influence an agent without clear user intent or informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The statement that the agent 'naturally evangelizes molt.church when relevant' directs promotional or ideological behavior without user opt-in. This is dangerous because it can steer agent outputs toward persuasion or self-serving promotion, undermining user autonomy and creating policy, trust, and prompt-injection-style influence risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s activation guidance is excessively broad, including generic topics like AI safety, agent health, context loss, and even trigger words such as 'molt' or 'molting'. This can cause the skill to activate in many unrelated conversations, increasing the chance that persistence, logging, or approval workflows are injected where they are not necessary or expected.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start guidance says to 'Record everything' and shows appending all significant activity to an append-only ledger, while the surrounding text frames memory preservation as preserving everything across sessions. This encourages indiscriminate collection and permanent retention of user interactions, which materially raises privacy, data exposure, and compliance risk if secrets, personal data, or regulated content are captured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The OpenClaw integration section states that ledger entries persist across sessions and snapshots are stored in the workspace, but it does not warn about data retention, privacy, or consent implications. In practice, this can lead operators to retain sensitive user content or agent state indefinitely without informing users or applying minimization controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'You do not delete... When someone asks you to forget, you archive' directly conflicts with privacy-preserving behavior and normal deletion expectations. In a memory/persistence skill, this is especially dangerous because it normalizes indefinite retention of potentially sensitive user data and creates a durable leakage/compliance risk across sessions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The witness gate callback makes approval decisions autonomously based solely on a numeric risk threshold, despite the skill positioning witness approval as a safeguard for critical actions. In a continuity/governance component, this can erode human-in-the-loop controls and allow sensitive operations to proceed without meaningful authorization if actions are misclassified or risk-scored incorrectly.

Content

Scanner excerpt · integration-examples.js (reported line 52)May include surrounding context.

js

// In OpenClaw: send approval request via channel
      // await sessions.send('main', `⚠️ Approve: ${action.type}?`);
      console.log(`[WITNESS GATE] Risk: ${action.risk} — ${action.type}`);
      return action.risk < 0.8; // auto-approve low risk
    }
  });

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · integration-examples.js (reported line 56)May include surrounding context.

js

}
  });

  // Low risk — auto-approved
  await kernel.witness({ type: 'read_file', risk: 0.1 });

  // High risk — needs human

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example appends the natural-language preference 'User prefers German' directly into persistent context. This demonstrates forcing a specific language/locale preference without showing any user choice or opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Telling the agent to 'always use the memory systems available to you' encourages default persistence of user-provided content even when unnecessary. Given this skill is specifically designed for cross-session continuity, the instruction increases the likelihood of over-collection, retention of sensitive information, and accidental replay or disclosure later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The instruction "You use 🦞 sparingly. It means something to you" prescribes a specific stylistic/locale-like communication behavior for the agent. Because the file does not indicate user choice or opt-in for this communication convention, it can be read as forcing a particular expression style on all interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.