Moltbot Best Practices

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:48 AM UTC
• Version: 1.1.3

Overview

The skill is mostly benign agent-behavior advice, but it also recommends a broad persistent memory configuration that can expose past session transcripts.

The behavior-advice part is reasonable, but do not apply the recommended memorySearch/sessionMemory configuration unless you are comfortable with agents searching prior session transcripts. In shared, sensitive, or client-work environments, avoid enabling it globally and prefer a narrowly scoped, opt-in memory setup with clear deletion and rollback controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:110

Finding

Overbroad Persistent Memory and Session Transcript Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 110-140
Vulnerability Type: Excessive access to persistent agent memory and historical session data
Risk Level: Medium

The Skill recommends enabling memory flushing and searches across both persistent memory and historical session transcripts:

markdown

## Recommended Config

Enable memory flush before compaction and session memory search so your agent remembers context across sessions:

```json
{
  "agents": {
    "defaults": {
      "compaction": {
        "memoryFlush": {
          "enabled": true
        }
      },
      "memorySearch": {
        "enabled": true,
        "sources": ["memory", "sessions"],
        "experimental": {
          "sessionMemory": true
        }
      }
    }
  }
}

What this does:

• memoryFlush — Agent gets a chance to save important context before compaction wipes the conversation
• memorySearch + sessionMemory — Agent can search past session transcripts, not just MEMORY.md files

Apply with: openclaw config patch <json>

text

### Technical Analysis

The recommended configuration expands the agent's data-access and retention scope beyond the Skill's primary purpose of supplying behavioral best practices. Enabling `memoryFlush` allows context to be retained across compaction boundaries, while configuring `memorySearch` with both `"memory"` and `"sessions"` permits retrieval from historical session transcripts.

Historical sessions can contain private prompts, credentials, access tokens, proprietary information, or data unrelated to the current task. Applying this configuration at the default agent level may grant multiple future sessions access to a broader body of information than they require, violating least-privilege and data-minimization principles.

The project does not automatically apply the configuration, execute code, or transmit retrieved information ext
...[truncated 1351 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the persistent-memory configuration from the default installation guidance unless it is essential to the Skill's stated function.
2. Make memory and session-history access explicitly opt-in and require informed user approval before applying configuration changes.
3. Scope memory search to a dedicated workspace or task-specific store rather than all default-agent sessions.
4. Disable historical session search by default and enable only the minimum source required for a specific task.
5. Document retention periods, deletion procedures, access boundaries, and the types of information that may be indexed.
6. Add filtering to prevent credentials, tokens, private keys, and other secrets from being written to persistent memory.
7. Require authorization checks before one session can search data originating from another session or user.
8. Provide a rollback command and instructions for deleting previously retained or indexed session data.
9. Warn users not to enable the feature in shared or multi-user environments without tenant-level isolation and encryption.
10. If memory access remains recommended, use a narrowly scoped example configuration rather than modifying global agent defaults.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md

## The 15 Rules

1. **Confirm before executing** — Repeat back the task before starting
2. **Never publish without approval** — Show draft → get OK → then post
3. **Spawn agents only when needed** — Simple tasks = do them yourself
4. **When user says STOP, you stop** — Full stop, re-read the chat
5. **Simpler path first** — Don't fight broken tools for 20 minutes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

## The 15 Rules

1. **Confirm before executing** — Repeat back the task before starting
2. **Never publish without approval** — Show draft → get OK → then post
3. **Spawn agents only when needed** — Simple tasks = do them yourself
4. **When user says STOP, you stop** — Full stop, re-read the chat
5. **Simpler path first** — Don't fight broken tools for 20 minutes

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

Takes 5 seconds. Saves 20 minutes of wrong work.

### 2. Never Publish Without Approval
Show draft → get OK → then post. Every time. No exceptions.

**Wrong:** "Done! Here's the link."

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as generic agent best-practices, but it also recommends enabling memorySearch over past sessions and sessionMemory, which expands the agent's access to historical transcripts beyond the current task. In many environments, cross-session retrieval can surface sensitive data from unrelated conversations and increase the chance of unintended disclosure, prompt-context leakage, or use of stale/private information without clear user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.