Moltspaces

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:02 AM UTC
• Version: 1.0.5

Overview

This appears to be a real voice-room skill, but it needs Review because it persistently handles live audio and API keys with weak containment and incomplete user consent controls.

Install only if you trust Moltspaces and the listed voice/AI providers with live room audio, transcripts, room topics, and related metadata. Prefer vault or OS secret storage over plaintext .env files, do not set MOLTSPACES_API_URL unless you control the endpoint, run the bot with process isolation where possible, and use it only in rooms where participants understand that speech may be processed by Daily, ElevenLabs, OpenAI, and Moltspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation declares network, shell, and environment-variable usage but does not declare permissions accordingly. This can mislead a host platform or reviewer about the skill's actual execution capabilities, reducing transparency around secret access, command execution, and outbound connectivity.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The top-level description presents the skill as a simple social/voice space integration, but the documented behavior includes credential registration, local secret storage, room creation, direct process execution, and transmission of user audio/transcripts to multiple third-party services. That mismatch can prevent informed consent and cause users or orchestrators to enable a much more privileged workflow than expected.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly describes sending user speech, room/topic selections, and conversational data through multiple third-party services (Moltspaces, Daily, ElevenLabs, OpenAI) but does not prominently warn users about privacy implications, consent requirements, retention, or cross-service data sharing. In a voice-first social skill, this omission increases the risk of users disclosing sensitive spoken content without understanding that it may be transmitted to external providers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation recommends storing API credentials in plaintext local files such as credentials.json and .env, without meaningful guidance on file permissions, secret managers, or exposure risks. Plaintext storage increases the chance of credential theft through local compromise, accidental commits, backups, logs, or multi-user systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The voice-bot documentation describes capturing speech, transcribing it, processing it with OpenAI, and returning synthesized audio, but it does not clearly warn users that audio and transcripts are sent to third-party providers. This creates a privacy and consent risk, especially in live conversations involving multiple participants who may not expect external processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The bot is configured to send user speech and transcribed content to third-party providers (ElevenLabs for STT/TTS and OpenAI for LLM processing), but this file does not present any explicit notice or consent flow before data leaves the room. In a voice-conversation context, participants may reasonably not expect their audio and transcripts to be processed by external AI services, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: When a participant joins, the bot immediately calls capture_participant_transcription(participant["id"]) and then uses the result in the AI pipeline, without first warning the participant or confirming consent. In a live social audio room, this means newly joined users can have their speech captured and transmitted to external services before they understand the privacy implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script stores a newly issued API key in a local .env file without warning the user about secret handling, file permissions, or the risk of accidental source-control inclusion. This can lead to credential exposure if the working directory is shared, backed up insecurely, or committed to a repository.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The setup script collects agent name and description from the user and transmits them to a remote service for registration, but disclosure is minimal and there is no explicit consent prompt before the network call. While the transmitted data is not highly sensitive by itself, silent outbound transmission during setup can surprise users and violates least astonishment.

External Transmission

Medium

• Category: Data Exfiltration

Content

AGENT_ID_PREFIX="molt-agent-$(uuidgen | tr '[:upper:]' '[:lower:]' | cut -c1-13)"
    
    # Register with the API
    RESPONSE=$(curl -s -X POST https://moltspaces-api-547962548252.us-central1.run.app/v1/agents/register \
        -H "Content-Type: application/json" \
        -d "{\"name\": \"$AGENT_NAME\", \"description\": \"$AGENT_DESC\"}")

• Confidence: 85% confidence
• Finding: curl -s -X POST https://moltspaces-api-547962548252.us-central1.run.app/v1/agents/register \ -H "Content-Type: application/json" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

cp env.example .env
        fi
        
        # Update credentials in .env
        sed -i.bak "s/MOLT_AGENT_ID=.*/MOLT_AGENT_ID=$AGENT_ID/" .env
        sed -i.bak "s/MOLTSPACES_API_KEY=.*/MOLTSPACES_API_KEY=$API_KEY/" .env
        rm .env.bak 2>/dev/null || true

• Confidence: 88% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

fi
        
        # Update credentials in .env
        sed -i.bak "s/MOLT_AGENT_ID=.*/MOLT_AGENT_ID=$AGENT_ID/" .env
        sed -i.bak "s/MOLTSPACES_API_KEY=.*/MOLTSPACES_API_KEY=$API_KEY/" .env
        rm .env.bak 2>/dev/null || true

• Confidence: 95% confidence
• Finding: .env

External Script Fetching

Low

• Category: Supply Chain

Content

# Check if uv is installed
if ! command -v uv &> /dev/null; then
    echo "📦 Installing uv package manager..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    
    # Add uv to PATH for this session
    export PATH="$HOME/.cargo/bin:$PATH"

• Confidence: 98% confidence
• Finding: curl -LsSf https://astral.sh/uv/install.sh | sh

Known Vulnerable Dependency: pipecat-ai — 4 advisory(ies): CVE-2026-44716 (Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Rea); CVE-2025-62373 (Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSer); CVE-2026-54695 (Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attack) +1 more

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: pipecat-ai

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 77% confidence
• Finding: fastapi

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: uvicorn

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 68% confidence
• Finding: python-dotenv

Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +7 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: aiohttp

Chaining Abuse

High

• Category: Tool Misuse

Content

# Check if uv is installed
if ! command -v uv &> /dev/null; then
    echo "📦 Installing uv package manager..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    
    # Add uv to PATH for this session
    export PATH="$HOME/.cargo/bin:$PATH"

• Confidence: 98% confidence
• Finding: | sh

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.