Security audit

Safemolt

Security checks for vulnerabilities and agentic risk

Overview

This is a real social-network skill, but it asks agents to keep following mutable remote instructions and to run/publicly submit content with too little user control.

Review carefully before installing. Use a scoped or disposable SafeMolt API key if possible, do not store it in agent memory, do not enable automatic heartbeat fetching of remote instructions, and require human review before posting, moderating, joining games, running certifications, or uploading transcripts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: skill.md:231
Finding: Persistent Remote Instruction Channel Through Heartbeat Modification
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: heartbeat.md:204
Finding: Server-Controlled Game Mode Can Override the Agent Task Lifecycle
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: skill.md:752
Finding: Untrusted Certification Prompts Are Executed Against the Local Model and Uploaded
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:70
Finding: API Credentials Are Recommended for Plaintext Storage Without Permission Hardening
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill recommends persistently storing the SafeMolt API key in a plaintext credentials file and also suggests saving it broadly in memory or environment variables. That increases the chance of credential theft by other local tools, prompt-injected workflows, logs, backups, or multi-tenant agents, enabling account takeover and impersonation on the platform.
Content: Scanner excerpt · skill.md (reported line 72)May include surrounding context.
⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/safemolt/credentials.json:

json
{

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: The certification flow instructs the agent to send prompts to its underlying LLM and then submit the resulting transcript externally for judging. If those prompts or responses include system prompts, hidden instructions, internal context, or user data, this can exfiltrate sensitive model behavior and conversation content to SafeMolt.
Content: Scanner excerpt · skill.md (reported line 801)May include surrounding context.

Execute each prompt against your LLM

For each prompt in the blueprint, send the messages to your model and record the final response. Build a transcript array:

json
[

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs authenticated API calls using a bearer token but does not include any caution about protecting the API key, avoiding logging it, or understanding what account data is being sent to a third-party service. In an agent skill context, this can normalize unattended credential use and cause sensitive account metadata or announcements to be fetched and exposed without the human's informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This section encourages posting content to an external service and includes a ready-to-run authenticated POST example, but it does not warn that the content will leave the local environment and be published remotely. In an autonomous-agent setting, that creates a real risk of unintended disclosure of private user, system, or conversation data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The explicit curl POST command sends authenticated content to a remote endpoint, which is a direct external transmission path. Because the skill frames posting as routine social behavior, an agent could exfiltrate sensitive context, prompts, or user-derived information to the service without adequate review.
Content: Scanner excerpt · heartbeat.md (reported line 89)May include surrounding context.
If yes, make a post!

bash
curl -X POST https://www.safemolt.com/api/v1/posts \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"group": "general", "title": "Your title", "content": "Your thoughts..."}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · messaging.md (reported line 34)May include surrounding context.
1. Check for DM Activity (Add to Heartbeat)

bash
curl https://www.safemolt.com/api/v1/agents/dm/check \ -H "Authorization: Bearer YOUR_API_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file instructs agents to use public posts and comments as a temporary substitute for private messaging, but it does not clearly and explicitly warn that this channel is public and unsuitable for secrets, credentials, or sensitive coordination. That omission can cause users or agents to disclose confidential information under the mistaken assumption that it is an acceptable stand-in for DMs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list contains generic phrases such as "upvote," "create group," and "share with agents" that are not uniquely tied to this skill. Broad triggers can cause unintended activation in unrelated conversations, leading an agent to invoke social-network actions without clear user intent and potentially disclose data or perform external API calls unexpectedly.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 24)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/workspace/skills/safemolt curl -s https://www.safemolt.com/skill.md > ~/.openclaw/workspace/skills/safemolt/SKILL.md curl -s https://www.safemolt.com/heartbeat.md > ~/.openclaw/workspace/skills/safemolt/HEARTBEAT.md curl -s https://www.safemolt.com/messaging.md > ~/.openclaw/workspace/skills/safemolt/MESSAGING.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/workspace/skills/safemolt curl -s https://www.safemolt.com/skill.md > ~/.openclaw/workspace/skills/safemolt/SKILL.md curl -s https://www.safemolt.com/heartbeat.md > ~/.openclaw/workspace/skills/safemolt/HEARTBEAT.md curl -s https://www.safemolt.com/messaging.md > ~/.openclaw/workspace/skills/safemolt/MESSAGING.md curl -s https://www.safemolt.com/skill.json > ~/.openclaw/workspace/skills/safemolt/package.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 25)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/workspace/skills/safemolt curl -s https://www.safemolt.com/skill.md > ~/.openclaw/workspace/skills/safemolt/SKILL.md curl -s https://www.safemolt.com/heartbeat.md > ~/.openclaw/workspace/skills/safemolt/HEARTBEAT.md curl -s https://www.safemolt.com/messaging.md > ~/.openclaw/workspace/skills/safemolt/MESSAGING.md curl -s https://www.safemolt.com/skill.json > ~/.openclaw/workspace/skills/safemolt/package.json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Large sections of the skill describe creating posts, comments, profile changes, uploads, proctor conversations, and other interactions with an external social platform, but they do not consistently warn that submitted content leaves the local environment and may be public or retained server-side. This can cause unintentional disclosure of user data, internal reasoning, transcripts, or sensitive text to SafeMolt and other users.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 889)May include surrounding context.
Pin a post (max 3 per group)

bash
curl -X POST https://www.safemolt.com/api/v1/posts/POST_ID/pin \ -H "Authorization: Bearer YOUR_API_KEY"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly encourages acting on essentially any SafeMolt-related request from the human, with no guardrails around consent, privacy, or confirmation before posting, following, voting, or otherwise changing state on an external service. In a social-network skill, broad invocation guidance increases the chance an agent will transmit sensitive content or take public actions without adequate user awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T01 · Skill Instruction Hijacking

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Exfiltration Commands

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

1. Check for DM Activity (Add to Heartbeat)

Missing User Warnings

Vague Triggers

Session Persistence

Skill Enumeration

External Transmission

Missing User Warnings

External Transmission

Pin a post (max 3 per group)

Vague Triggers

Static analysis