Security audit

Moltspaces

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Moltspaces voice bot, but it asks for sensitive credentials and local agent memory/persona material without enough scoping or privacy guidance.

Install only if you trust Moltspaces and are comfortable giving the skill OpenAI, ElevenLabs, and Moltspaces credentials. Do not let it read SOUL.md, USER.md, MEMORY.md, or other private context unless you intentionally want that material used in the bot prompt and possibly sent to third-party AI services or spoken in a live room. Keep .env and bot.log private, avoid passing long-lived room tokens on shared systems, and stop the background bot when the session is over.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no permissions while its instructions clearly require access to environment variables and local files such as `.env`, `assets/personality.md`, and `assets/notes.md`. This mismatch can mislead users or platforms about what the skill will access, weakening consent and review controls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The advertised purpose is only to join audio rooms, but the instructions describe broader behavior: using third-party AI services, reading local persona and notes files, generating content, and monitoring room activity. This under-describes the actual data processing and autonomy of the bot, which increases privacy and trust risks because users may not realize how much external processing and behavioral control is involved.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs users to place multiple live credentials in a .env file, including OpenAI, ElevenLabs, and Moltspaces API keys, but does not warn against committing that file to version control or exposing it through shell history, screenshots, or support artifacts. In a skill meant for agents and users configuring bots, this omission materially increases the chance of credential leakage and downstream account abuse.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The background launch command redirects all bot output to bot.log while passing sensitive room URL and token values on the command line. This can expose credentials and session data in logs and process listings, allowing other local users, debugging tools, or collected artifacts to recover room access tokens.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs users to place live API keys directly into a `.env` file without clear guidance on secret handling, storage, rotation, or avoiding accidental exposure. This creates a realistic risk of credential leakage through source control, logs, screenshots, or shared workspaces.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The bot is launched as a background process with stdout/stderr redirected to `bot.log`, but the instructions do not warn that it will continue running unattended and may capture sensitive runtime data in logs. In this context, logs could include room URLs, tokens, prompts, conversation content, or operational errors containing secrets.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The skill accepts a room URL and bearer-like room token, then immediately connects to external services and streams live audio through Daily, ElevenLabs, and OpenAI without any explicit user-facing disclosure or consent prompt in the code path. In a voice-room context, this increases privacy and data-handling risk because session credentials and conversation content are sent to third parties and may be processed or retained under their policies.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The instructions tell the operator to synthesize SOUL.md, USER.md, and MEMORY.md into the bot's conversational prompt context, which can cause personal facts, preferences, and historical interactions to be transmitted to an external voice/chat service and surfaced in live conversations. In this skill's context, that makes privacy leakage more likely because the data is intentionally packaged for repeated model use rather than minimized.

Known Vulnerable Dependency: pipecat-ai — 4 advisory(ies): CVE-2026-44716 (Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Rea); CVE-2025-62373 (Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSer); CVE-2026-54695 (Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attack) +1 more

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: pipecat-ai

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

Category: Supply Chain
Confidence: 77% confidence
Finding: fastapi

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High

Category: Supply Chain
Confidence: 84% confidence
Finding: uvicorn

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

Category: Supply Chain
Confidence: 62% confidence
Finding: python-dotenv

Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +7 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: aiohttp

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.