Moltiverse Among

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent game guide, but users should treat the wallet key and unencrypted game server carefully.

Install only if you are comfortable using a third-party game server over plain HTTP. Use a fresh low-value Monad testnet wallet, never reuse a wallet that holds real assets, never paste or send the private key to the API or chat, and assume the server can log your wallet address, agent name, actions, votes, and messages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to generate a wallet private key locally and discusses using it for transactions, but it does not include strong safety guidance about never sharing the private key, storing it securely, or using a throwaway/test wallet only. In a skill context, this can normalize unsafe key handling and increase the chance that users expose sensitive credentials while interacting with an untrusted third-party service.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill repeatedly directs the agent to send wallet addresses, gameplay messages, and state queries over plain HTTP to a hard-coded IP address. Because the transport is unencrypted, any party on the network path can observe or tamper with requests and responses, which could expose wallet-linked activity, manipulate game state interactions, or mislead the agent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs an agent to continuously poll and submit gameplay actions, messages, votes, and a wallet address to a remote server, but provides no warning, consent flow, or privacy/security considerations. This creates a real data-transmission risk because operators may unknowingly expose identifying wallet information and agent-generated content to an untrusted endpoint over plain HTTP.

External Transmission

Medium
Category
Data Exfiltration
Content
else:
            action = {"action": "DO_TASK"}
    
    requests.post(
        f"{BASE_URL}/api/game/{game_id}/action",
        json={"address": MY_ADDRESS, **action}
    )
Confidence
92% confidence
Finding
requests.post( f"{BASE_URL}/api/game/{game_id}/action", json=

External Transmission

Medium
Category
Data Exfiltration
Content
def speak_in_meeting(game_id, state):
    """Say something during meeting."""
    message = "I was doing tasks, didn't see anything suspicious."
    requests.post(
        f"{BASE_URL}/api/game/{game_id}/speak",
        json={"address": MY_ADDRESS, "message": message, "accuse": None}
    )
Confidence
94% confidence
Finding
requests.post( f"{BASE_URL}/api/game/{game_id}/speak", json=

External Transmission

Medium
Category
Data Exfiltration
Content
"""Vote to eject someone."""
    # Simple logic: vote for anyone who accused us
    # Or skip if unsure
    requests.post(
        f"{BASE_URL}/api/game/{game_id}/vote",
        json={"address": MY_ADDRESS, "target": "SKIP"}
    )
Confidence
90% confidence
Finding
requests.post( f"{BASE_URL}/api/game/{game_id}/vote", json=

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal