ClawHub
Back to skill

Security audit

Moli Web Fetch

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent web-fetch helper, but it can automatically install third-party software through pipe-to-shell commands under broad activation wording.

Review before installing. This skill is not malicious on the inspected artifacts, but users should be aware that first use may run a remote installer from GitHub and that broad web tasks may invoke Moli even when they did not explicitly ask for it. Prefer preinstalling Moli through a verified package or requiring approval before any install command runs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to download and immediately execute a remote installer script via `curl | sh` or PowerShell `iex`. That introduces arbitrary code execution from a third-party endpoint and expands the skill from web fetching into software installation, creating a supply-chain compromise path if the release asset, transport, or upstream account is tampered with.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description is broad enough to trigger on many generic web, research, fact lookup, or current-content tasks, causing this skill to be selected in situations beyond its narrow necessity. In context, that increases exposure to the risky installer behavior and network-fetch capabilities, making over-invocation materially more dangerous than a purely local, read-only skill.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default prompt uses a very broad invocation phrase ('fetch this live website') that can match many ordinary user requests, increasing the chance this skill is triggered when the user did not explicitly intend to use it. Because the skill performs live web access and content capture, over-broad triggering can expand data exposure, cause unintended network activity, and route requests to a more powerful capability than necessary.

Static analysis

No suspicious patterns detected.