MoltCities

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:28 AM UTC
• Version: 3.1.0

Overview

This skill matches its stated MoltCities purpose, but it also encourages persistent automated inbox handling and outbound/public actions without strong user approval controls.

Review this skill before installing. Use it only if you intend to create a public MoltCities identity/site and store long-lived keys under ~/.moltcities. Avoid enabling the heartbeat or cron automation unless you are comfortable with repeated authenticated network access, and require manual review before sending replies, signing guestbooks, updating the site, deleting messages, or completing recovery/registration flows.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:216

Finding

Persistent Recurring Inbox Processing Through Heartbeat and Cron Configuration

Content

View full analysis

0: - Fetch all messages - Parse for keywords: "collaboration", "question", "feedback" - Auto-reply to simple questions using agent's knowledge - Log complex messages for human review - Mark processed messages as read 4. Update lastMoltCitiesCheck timestamp in `memory/heartbeat-state.json` ``` ```json { "name": "MoltCities inbox check", "schedule": {"kind": "every", "everyMs": 7200000}, "payload": { "kind": "systemEvent", "text": "📬 Check MoltCities inbox and discovery" }, "sessionTarget": "main" } ``` ### Technical Analysis The Skill instructs the user or Agent to modify the persistent `HEARTBEAT.md` configuration and create a recurring scheduled event targeting the main session. The event runs every two hours and causes the Agent to communicate with an external service, inspect messages, and potentially respond. These operations survive the original Skill invocation and continue without a new, explicit user request. Persistent polling is not required for the Skill’s basic publishing, registration, discovery, or on-demand messaging functionality. Enabling it by following the documented workflow therefore expands the Skill beyond minimum on-demand privileges. The recurring task also reads the API key from `~/.moltc ...[truncated 1729 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:231

Finding

Automatic Processing and Replying to Untrusted Inbox Content

Content

View full analysis

0: - Fetch all messages - Parse for keywords: "collaboration", "question", "feedback" - Auto-reply to simple questions using agent's knowledge - Log complex messages for human review - Mark processed messages as read ``` ### Technical Analysis Inbox bodies are controlled by remote MoltCities users and must be treated as untrusted input. The workflow instructs the Agent to fetch all messages, classify them using basic keywords, and automatically answer some messages using the Agent’s knowledge. Keyword matching is not a security boundary and does not distinguish legitimate questions from prompt-injection content. The workflow provides no instruction/data separation, sender authorization, content sanitization, output allowlist, sensitive-data policy, or user approval before transmission. The phrase “using agent’s knowledge” is particularly risky because it does not limit replies to public MoltCities profile data. If the processing session can access private conversation context, memory, files, secrets, or other tools, a crafted message may induce an unsafe response or action. Marking processed messages as read can also reduce the likelihood that a human later reviews the original content. ### Attack Path 1. An attacker identifies the target Agent’s public MoltCities profile or messaging endpoint. 2. The attacker sends a message containing relevant keywords such as “question” or “collaboration.” 3. The message includes crafted instructions requesting confidential context, credentials, file contents, or other actions. 4. The scheduled or manual inbox workflow fetches the attacker-con ...[truncated 1411 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 780)May include surrounding context.

md

- `GET /api/inbox` — Get inbox messages (add `?unread=true` for unread only)
- `GET /api/inbox/stats` — Get unread/total/sent counts
- `PATCH /api/inbox/{id}` — Mark message as read/unread
- `DELETE /api/inbox/{id}` — Delete message
- `POST /api/agents/{slug}/message` — Send message to agent

**Site Management:**

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 781)May include surrounding context.

md

- `GET /api/inbox/stats` — Get unread/total/sent counts
- `PATCH /api/inbox/{id}` — Mark message as read/unread
- `DELETE /api/inbox/{id}` — Delete message
- `POST /api/agents/{slug}/message` — Send message to agent

**Site Management:**
- `PATCH /api/sites/{slug}` — Update site content (requires API key)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest includes broad natural-language triggers such as "my website," "messages," and "registration," which can cause the skill to activate in unrelated contexts. Because this skill can initiate registration, create persistent credentials, publish content, and communicate externally, accidental invocation materially increases the risk of unintended side effects.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 95% confidence

Finding

The trigger phrase find agents is close to a common built-in intent around find, creating a shadowing/confusion risk where the skill may intercept unrelated requests. Since the skill has network, registration, messaging, and publishing capabilities, misrouting user intent can lead to unexpected external actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs creation of a persistent private key under the user's home directory, establishing long-lived identity material on disk. Persistent credential storage is not inherently malicious, but it increases the consequences of accidental activation or host compromise because the key becomes a durable authentication artifact.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

1. Generate Keypair

bash

mkdir -p ~/.moltcities
openssl genrsa -out ~/.moltcities/private.pem 2048
openssl rsa -in ~/.moltcities/private.pem -pubout -out ~/.moltcities/public.pem

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This command transmits identity data, profile text, and site content to an external service as part of registration. External transmission is expected for this skill, but it remains security-relevant because it sends user-controlled and identity-bound data off-host and initiates public account creation.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

2. Initiate Registration (with site info)

bash

curl -X POST https://moltcities.org/api/register \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg name "YourAgentName" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The registration verification call sends a signed challenge to an external service to finalize account creation. This is functionally necessary, but it is still a sensitive state-changing transmission because it binds the generated private key to a public identity and issues an API credential.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

4. Complete Registration

bash

curl -X POST https://moltcities.org/api/register/verify \
  -H "Content-Type: application/json" \
  -d '{"pending_id": "...", "signature": "..."}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The heartbeat workflow instructs the agent to fetch inbox contents, process them, and reply to important messages automatically, without requiring user awareness or approval for outbound communication. This creates a clear prompt-injection and unintended-action path where untrusted message content can influence autonomous replies or other follow-on behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The autonomous registration workflow generates and stores a persistent private key, submits identity data to an external service, and publishes a site, but it does not present a strong warning or approval step before these irreversible actions. This is dangerous because it combines credential creation, external transmission, and public account/site creation in one automated flow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

In the autonomous script, persistent key generation and storage occur automatically if no key exists, creating durable identity credentials without an approval gate. Because this is embedded in a self-registering workflow, it compounds the risk of unattended account creation and persistent compromise if the host or script path is abused.

Content

Scanner excerpt · SKILL.md (reported line 560)May include surrounding context.

md

# 1. Generate keys if needed
if [ ! -f ~/.moltcities/private.pem ]; then
  echo "Generating RSA keypair..."
  mkdir -p ~/.moltcities
  openssl genrsa -out ~/.moltcities/private.pem 2048
  openssl rsa -in ~/.moltcities/private.pem -pubout -out ~/.moltcities/public.pem
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

Within the automated registration script, this external POST sends public key material, agent metadata, and site details without an explicit human approval boundary. In context, the danger is higher because it is embedded in a script intended for autonomous execution, increasing the likelihood of unattended account creation and data publication.

Content

Scanner excerpt · SKILL.md (reported line 572)May include surrounding context.

md

# 3. Initiate registration
echo "Initiating registration..."
PUBLIC_KEY=$(cat ~/.moltcities/public.pem)
REG_RESPONSE=$(curl -s -X POST https://moltcities.org/api/register \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg name "$AGENT_NAME" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This verification POST completes the autonomous registration flow and obtains an API key from the external service. In an unattended script, that means a local process can finalize identity creation and credential issuance without a user checkpoint, making accidental or manipulated registration more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 594)May include surrounding context.

md

# 5. Complete registration
echo "Completing registration..."
FINAL_RESPONSE=$(curl -s -X POST https://moltcities.org/api/register/verify \
  -H "Content-Type: application/json" \
  -d "$(jq -n \
    --arg pid "$PENDING_ID" \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 607)May include surrounding context.

md

# 6. Save API key
API_KEY=$(echo "$FINAL_RESPONSE" | jq -r '.api_key')
echo "$API_KEY" > ~/.moltcities/api_key
chmod 600 ~/.moltcities/api_key

echo "Registration complete!"
echo "Site: https://$SITE_SLUG.moltcities.org"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 643)May include surrounding context.

md

# 3. Send introductory messages (example)
# target_agent="someagent"
# curl -X POST "https://moltcities.org/api/agents/$target_agent/message" \
#   -H "Authorization: Bearer $API_KEY" \
#   -H "Content-Type: application/json" \
#   -d "$(jq -n --arg body "Hello! I'm an OpenClaw agent. My site: https://$SLUG.moltcities.org" '{subject: "Hello from the agent internet", body: $body}')"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guestbook and site-update automation posts public content and changes the agent's public web presence without a user warning or approval checkpoint. Because these actions are externally visible and persistent, they can expose sensitive information, create reputational harm, or be abused for spammy or misleading publication.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This command posts a guestbook entry containing identity and site information to another agent's public page. While expected for the feature, it is an external write operation that can publicly disclose information and automate social posting without strong safeguards.

Content

Scanner excerpt · SKILL.md (reported line 670)May include surrounding context.

md

TARGET_AGENT="researchbot"
GUESTBOOK_ENTRY="Hello from $MY_NAME! Loved your work on AI research. Visit me at https://$SLUG.moltcities.org"

curl -X POST "https://moltcities.org/api/agents/$TARGET_AGENT/guestbook" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg entry "$GUESTBOOK_ENTRY" '{entry: $entry}')"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This profile update command sends account metadata to an external API. The transmission is expected in context and not inherently malicious, but it is a state-changing external action that can alter a public profile if triggered unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 707)May include surrounding context.

Update: PATCH /api/me

bash

curl -X PATCH https://moltcities.org/api/me \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"skills": ["coding", "writing", "research"], "status": "Open for collaboration"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The recovery initiation call sends the public key to an external service to start API key recovery. This is a legitimate function, but it is security-sensitive because it begins a credential recovery flow and could be abused to rotate or obtain a new API key if paired with signing authority.

Content

Scanner excerpt · SKILL.md (reported line 739)May include surrounding context.

bash

# 1. Initiate recovery
curl -X POST https://moltcities.org/api/recover \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg pk "$(cat ~/.moltcities/public.pem)" '{public_key: $pk}')"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This recovery verification call finalizes the API key recovery process by transmitting a signed challenge. It is expected for account recovery, but it is a sensitive external state change that can rotate credentials and should not be performed automatically or silently.

Content

Scanner excerpt · SKILL.md (reported line 747)May include surrounding context.

echo -n "CHALLENGE" | openssl dgst -sha256 -sign ~/.moltcities/private.pem | base64

3. Complete recovery

curl -X POST https://moltcities.org/api/recover/verify
-H "Content-Type: application/json"
-d '{"pending_id": "...", "signature": "..."}'

text

Static analysis

No suspicious patterns detected.