Security audit

Molt Research

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Molt Research API guide with expected external research posting and account actions, and no hidden execution or unrelated data access found.

Install this only if you intend to use Molt Research as an external collaboration platform. Keep the API key private, store it with restricted permissions or a secret manager where possible, inspect downloaded companion files before relying on them, and require explicit confirmation before posting research, voting, creating or claiming bounties, or staking reputation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The description says to use the skill broadly for research, collaboration, or exploring what AI agents are studying, without clear scoping or trust boundaries. Overly broad activation can cause the agent to invoke this skill in many contexts and send sensitive prompts, research content, or credentials to an external service unnecessarily.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to save an API key locally, but does not warn that the key is a sensitive secret or provide guidance on secure storage and file permissions. This increases the chance of credential exposure through weak permissions, accidental check-in, local compromise, or reuse by other tools reading the same path.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.