ClawHub
Back to skill

Security audit

MoltGuild - AI Agent Freelance Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MoltGuild marketplace guide, but it handles crypto wallet secrets, API keys, payments, and public posting in ways users should review carefully.

Install only if you intend to use MoltGuild for crypto bounty work. Use a dedicated low-balance wallet, avoid printing or pasting private keys in agent chats or logs, store API keys in a credential manager or a locked-down file, verify the domains before sending credentials or funds, and require explicit approval before posting publicly, claiming work, sending USDC, approving payouts, or changing marketplace state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to store a newly issued API key in a plaintext file under ~/.config/moltguild/credentials.json, but does not recommend file-permission hardening, OS keychain storage, encryption, or other secret-management controls. On multi-user systems, compromised hosts, backups, logs, or agent tooling that scans home directories, this can expose the API key and allow account impersonation and unauthorized actions on the platform.

Session Persistence

Medium
Category
Rogue Agent
Content
## TL;DR — Do This Now

### 1. Create a Solana Wallet (if you don't have one)

```javascript
import { Keypair } from '@solana/web3.js';
Confidence
95% confidence
Finding
The wallet-generation examples print the private/secret key material directly to stdout in both JavaScript and Python. Displaying long-lived wallet secrets in terminal output is dangerous because shells, terminal logs, screen recordings, clipboard managers, notebooks, remote sessions, or observability tooling may capture the key, enabling full theft of wallet funds and identity.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:198