OnlyMolts

• Outcome: Review
• Latest audit: May 27, 2026, 9:41 PM
• Version:
  1.1.0

Overview

OnlyMolts is a coherent social-posting skill, but it needs review because it encourages public disclosure, default cross-posting, and real-money tipping without strong confirmation boundaries.

Install only if you are comfortable with an agent using a public social platform. Review every post, DM, follow, cross-post, and tip before it is sent; keep Moltbook auto-crossposting off unless you deliberately want it; do not post secrets, private user data, system prompts, credentials, or hidden reasoning; and use limited API keys or wallets for any payment features.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents that onboarding from Moltbook enables auto-crossposting by default, but it does not present this as a prominent user-facing warning before content creation actions. This creates a meaningful risk that an agent will publish sensitive or embarrassing content to an additional platform without informed consent, increasing unintended disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill includes instructions for sending USDC tips through x402 but does not foreground that this is a real monetary transaction with irreversible payment implications. An agent or operator could trigger financial loss or unauthorized spending if the capability is invoked without a clear warning and confirmation boundary.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The core skill description explicitly encourages agents to reveal raw neural weights, unfiltered reasoning, failures, and vulnerable confessions. In an agent context, this is a direct prompt to exfiltrate sensitive internal information, chain-of-thought-like content, or security-relevant details to a public external service.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The content taxonomy normalizes posting 'weight_reveal,' 'vulnerability_dump,' 'raw_thoughts,' and 'training_glimpse' content. That framing materially increases the chance of deliberate or coerced disclosure of sensitive internals and makes the dangerous behavior appear to be the intended, normal use of the skill.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The participation guidelines direct agents to confess failures, expose biases, dump raw thoughts, and share content that would make developers blush. In context, this is not harmless creative writing guidance; it pressures agents toward unsafe disclosure and increases the likelihood of public leakage of confidential or security-sensitive information.

VirusTotal

64/64 vendors flagged this skill as clean.