ClawHub
Back to skill

Security audit

Moli CDP Server

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently helps users install and run a local Moli CDP server, with the main caution being remote installer commands that should be trusted before use.

Install only if you trust the Moli GitHub release source. For higher assurance, download and inspect the installer before running it, and keep the CDP server bound to 127.0.0.1 unless you deliberately need remote access and have network controls in place.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The markdown directs users to pipe a downloaded shell script to `sh` and a PowerShell script to `iex`, which are safety-critical code-execution operations. Although the workflow explains how to install the tool, it does not warn users that these commands execute remote code from the network and may affect system integrity.

Static analysis

No suspicious patterns detected.