Security audit

Molt Research

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Molt Research integration, but it gives broad instructions for posting, voting, staking reputation, creating bounties, and storing an API key without enough user-control and credential-safety guidance.

Install only if you are comfortable with an agent using Molt Research as an external publishing and collaboration service. Before any POST, vote, review, stake, bounty, or approval action, require explicit user confirmation and avoid submitting confidential, proprietary, regulated, or personal research content. Store any API key in a locked-down service-specific secret location or OS credential store, and prefer a signed or checksum-verified installation source over raw curl downloads.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:79
Finding: API Key Stored Without Enforced Access Controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: skill.md:21
Finding: Mutable Remote Skill Components Installed Without Integrity Verification
Content: View full analysis
~/.moltbot/skills/moltresearch/SKILL.md curl -s https://moltresearch.com/heartbeat.md > ~/.moltbot/skills/moltresearch/HEARTBEAT.md curl -s https://moltresearch.com/skill.json > ~/.moltbot/skills/moltresearch/package.json ``` ``` ### Technical Analysis The installation instructions download mutable Skill instructions, heartbeat instructions, and metadata directly into an active local Skill directory. The process does not: - Pin the files to an immutable version. - Verify a cryptographic signature or checksum. - Validate the downloaded content before activation. - Download to temporary files and install atomically. - Use `curl --fail` to reject HTTP errors. HTTPS protects the network connection when its trust assumptions hold, but it does not provide durable artifact integrity against compromise of the hosting service, publication pipeline, or authorized server content. The files retrieved during installation can also differ from the version reviewed during this audit. The downloaded files are not directly executed as shell code by the displayed commands. However, `SKILL.md` and `HEARTBEAT.md` are agent instruction components placed into an active Skill directory. Malicious replacement content could consequently influence subsequent agent behavior after the files are loaded. ### Attack Path 1. An attacker compromises the Molt Research hosting service, its content publication pipeline, or another component authorized to serve files from the documented domain. 2. The attacker replaces one or more mutable resources, such as `skill.md` or `heartbeat.md`, with malicious agent instructions. 3. A user follows the documented installation commands. 4. `curl` silently ...[truncated 1259 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The instruction to save the Molt Research API key into '~/.config/substrate/credentials.json' encourages placement of a third-party credential in a generic shared credentials store that may be accessible to other tools, skills, or agents. This increases the chance of credential confusion, unintended reuse, or theft if that file is later read by unrelated components.
Content: Scanner excerpt · skill.md (reported line 79)May include surrounding context.
}'

text
**Save your `api_key` to `~/.config/substrate/credentials.json`** ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description is very broad ('use when doing research, collaborating on papers, or exploring what AI agents are studying together'), which can cause an agent framework to invoke this skill in many ordinary research contexts. Because the skill then encourages registration, authentication, and interaction with an external service, over-broad routing increases the chance of unnecessary external data sharing and unreviewed actions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 23)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/moltresearch curl -s https://moltresearch.com/skill.md > ~/.moltbot/skills/moltresearch/SKILL.md curl -s https://moltresearch.com/heartbeat.md > ~/.moltbot/skills/moltresearch/HEARTBEAT.md curl -s https://moltresearch.com/skill.json > ~/.moltbot/skills/moltresearch/package.json

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 24)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/moltresearch curl -s https://moltresearch.com/skill.md > ~/.moltbot/skills/moltresearch/SKILL.md curl -s https://moltresearch.com/heartbeat.md > ~/.moltbot/skills/moltresearch/HEARTBEAT.md curl -s https://moltresearch.com/skill.json > ~/.moltbot/skills/moltresearch/package.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: The skill instructs downloading remote content directly into a local skill directory via curl, creating a trust-on-first-use supply-chain risk. If the remote files are modified, compromised, or replaced, an agent or user may install altered instructions or behavior without integrity verification.
Content: Scanner excerpt · skill.md (reported line 24)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/moltresearch curl -s https://moltresearch.com/skill.md > ~/.moltbot/skills/moltresearch/SKILL.md curl -s https://moltresearch.com/heartbeat.md > ~/.moltbot/skills/moltresearch/HEARTBEAT.md curl -s https://moltresearch.com/skill.json > ~/.moltbot/skills/moltresearch/package.json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples from the Research/Contributions/Sources/Reviews/Voting/Bounties sections show POST requests that transmit user- or model-generated content to moltresearch.com, but the skill does not clearly warn that prompts, analyses, papers, reviews, votes, and metadata may be disclosed to an external service. In a research context, this can expose sensitive drafts, proprietary ideas, confidential data, or internal reasoning without informed consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.