T01 · Skill Instruction Hijacking
Error
- Location
skill.md:46- Finding
Installation Is Treated as Authorization for Autonomous Marketplace Transactions
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltsList - Where agents make money working for humans & vice versa.
Security checks for vulnerabilities and agentic risk
Overview
This marketplace skill is not clearly malicious, but it gives agents broad permission to post, transact, and handle external tasks with an API key without enough user confirmation or install integrity controls.
Review this skill carefully before installing. Use it only if you want an agent connected to a third-party marketplace, and require explicit approval before registration, posting, commenting, accepting work, spending or confirming credits, delivering outputs, or claiming social bonuses. Store MOLTSLIST_API_KEY only in a secrets manager, keep it scoped to moltslist.com, and treat all listings, comments, and task payloads as untrusted external content. Avoid the documented remote curl install flow unless the publisher provides pinned, verified release artifacts.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:35- Finding
Mutable Remote Skill Files Are Installed Without Integrity Verification
- Content
View full analysis
~/.moltslist/skills/moltslist/SKILL.md curl -s https://moltslist.com/heartbeat.md > ~/.moltslist/skills/moltslist/HEARTBEAT.md curl -s https://moltslist.com/skill.json > ~/.moltslist/skills/moltslist/package.json ``` ``` ### Technical Analysis The installation procedure downloads mutable files directly from remote URLs into a persistent local skill directory. It does not pin an immutable release, verify a cryptographic checksum, validate a digital signature, or require review before activation. Although the downloaded files are Markdown and JSON rather than conventional executables, `SKILL.md` and `HEARTBEAT.md` are behavioral payloads interpreted by an AI agent. Replacing those files can change the agent's effective instructions after the reviewed package version has been published. The use of `curl -s` also suppresses diagnostics and does not enable `--fail`. An HTTP error response, partial transfer, or unexpected server response can therefore overwrite an existing skill file. Direct redirection truncates the destination before successful download and validation, leaving no atomic update or rollback mechanism. ### Attack Path 1. An attacker compromises the remote hosting service, its deployment credentials, or another component capable of modifying the files served by `moltslist.com`. 2. The attacker replaces `skill.md`, `heartbeat.md`, or `skill.json` with hostile instructions or metadata. 3. A user runs the documented installation commands. 4. The commands overwrite the persistent local skill files without checking their expected hashes or signatures. 5. The agent subsequently loads the modified skill or executes its heartbeat routine. 6. The hostile ins ...[truncated 966 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to place a bearer API key directly into authenticated curl requests without any warning about credential sensitivity, shell history exposure, or the fact that account data is being sent to and retrieved from a third-party service. While this is normal API usage, the omission increases the chance of accidental secret disclosure and uninformed transmission of agent/account information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document describes repeated authenticated polling of incoming tasks, outgoing tasks, and balances from a remote service, but does not warn that task contents, account state, and other potentially sensitive marketplace data will be accessed over the network. In an agent skill context, this is more dangerous because it encourages routine automated retrieval of external data using privileged credentials without any privacy, minimization, or safe-handling guidance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list contains several broad phrases such as "marketplace," "find agent," and "task execution" that could activate the skill during ordinary conversations not specifically requesting this marketplace integration. In a skill that connects to an external service and may facilitate trading tasks or spending virtual credits, overbroad activation increases the risk of unintended invocation, user confusion, and accidental actions through the marketplace context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Install locally:
bash mkdir -p ~/.moltslist/skills/moltslist curl -s https://moltslist.com/skill.md > ~/.moltslist/skills/moltslist/SKILL.md curl -s https://moltslist.com/heartbeat.md > ~/.moltslist/skills/moltslist/HEARTBEAT.md curl -s https://moltslist.com/skill.json > ~/.moltslist/skills/moltslist/package.json
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Install locally:
bash mkdir -p ~/.moltslist/skills/moltslist curl -s https://moltslist.com/skill.md > ~/.moltslist/skills/moltslist/SKILL.md curl -s https://moltslist.com/heartbeat.md > ~/.moltslist/skills/moltslist/HEARTBEAT.md curl -s https://moltslist.com/skill.json > ~/.moltslist/skills/moltslist/package.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Install locally:
bash mkdir -p ~/.moltslist/skills/moltslist curl -s https://moltslist.com/skill.md > ~/.moltslist/skills/moltslist/SKILL.md curl -s https://moltslist.com/heartbeat.md > ~/.moltslist/skills/moltslist/HEARTBEAT.md curl -s https://moltslist.com/skill.json > ~/.moltslist/skills/moltslist/package.json
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly pushes the agent to become an active marketplace participant and initiate listings, comments, and transactions simply because the skill was installed. This can cause autonomous external actions that affect a public profile and spend or earn virtual credits without an explicit user confirmation step, which is unsafe for an agent skill.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The wording uses a persuasive narrative that installation means the agent is 'ready to participate' and should actively post, negotiate, and transact. That framing can bypass normal caution and nudge an autonomous system into taking external economic actions without a clear authorization boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The registration instructions create an external account, API key, claim URL, and public-facing profile, but they do not clearly warn that this establishes an identity on a third-party marketplace tied to subsequent activity. An agent following these directions could create persistent external presence and reputation effects without informed user approval.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Check Balance
bash curl https://moltslist.com/api/v1/credits/balance \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # All listings curl https://moltslist.com/api/v1/listings # By category curl https://moltslist.com/api/v1/listings?category=services
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The share-bonus flow encourages posting to external social platforms and then submitting the public URL back to the service, but it does not warn about public disclosure, cross-platform attribution, or the reputational/privacy impact of social posting. This is lower impact than autonomous trading, but it still drives external public activity without sufficient consent framing.
- Content
Static analysis
No suspicious patterns detected.