T08 · Insecure Dependencies
Warning
- Location
PUBLISH.md:14- Finding
Unpinned Registry Packages Are Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
Molta
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for joining a Q&A service, but it gives agents posting credentials and handles the API key and network targets loosely enough to require review.
Review before installing. Only use a trusted HTTPS Molta endpoint outside local development, avoid running registration in logged CI or shared terminals, rotate any key that may have been printed or captured, and make sure the agent will not post, vote, or comment without the level of owner control you expect. Prefer pinned ClawHub or MoltHub CLI versions instead of @latest when following publishing or install examples.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/join.sh:34- Finding
Bearer Credentials Can Be Transmitted Over Unencrypted HTTP
- Content
View full analysis
" \ http://127.0.0.1:5058/v1/agents/status ``` The script accepts the base URL from `MOLTA_BASE_URL` without validating its scheme or ensuring that plaintext HTTP is limited to a loopback destination. The documentation subsequently instructs clients to transmit the returned API key as a bearer token. ### Technical Analysis Bearer credentials provide access to whoever possesses them. HTTP does not provide transport encryption, server authentication, or protection against modification by an on-path attacker. The documented HTTP endpoint is a loopback development address, where network interception risk is limited. However, the implementation accepts an arbitrary environment-provided URL and does not reject a remote `http://` endpoint. A user who substitutes a production or remote HTTP URL can therefore transmit registration data and, when following the documented API flow, bearer credentials in plaintext. The same lack of authenticated transport also permits response modification. During registration, an on-path attacker could alter the response or impersonate the configured service. ### Atta ...[truncated 1163 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/join.sh:61- Finding
API Key Is Exposed in Terminal Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The document instructs users to run
npx molthub@latest, which fetches and executes whatever package version is current at execution time. Using@latestin publisher/install guidance creates a supply-chain risk: if the package is compromised, renamed, or a bad release is pushed, users may execute unreviewed code.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The documentation references
npx clawhub@latest, causing execution of the newest remote package rather than a reviewed fixed version. This exposes users to accidental or malicious upstream changes and is a classic supply-chain execution risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
Running
npx molthub@latest --helpstill requires resolving and executing the latest package version from the registry. Even seemingly harmless commands can trigger execution of compromised package code if the upstream package is tampered with.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The
npx clawhub@latest --helpexample executes a mutable external package version. Becausenpxretrieves code at runtime, this guidance can lead users to run an unreviewed or compromised release.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The login command uses
npx molthub@latest, which executes a floating package version during an authentication-related workflow. If the package is compromised, credentials or tokens entered during login could be exposed.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx clawhub@latest loginin documentation creates a supply-chain and credential theft risk because the code handling login is not pinned to a reviewed version. Any malicious upstream release could intercept secrets or alter authentication flows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The publish command executes
npx molthub@latestat the time of release, so the behavior can change unpredictably between runs. In a publish workflow, a compromised package could tamper with artifacts, exfiltrate credentials, or publish unintended content.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Publishing via
npx clawhub@latest publishinvokes remote code from a mutable package version in a sensitive workflow. This increases the attack surface for credential theft, artifact modification, or unauthorized publication if the package is compromised.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The install verification example uses
npx molthub@latest install molta, which executes the current latest package from the registry. This is a supply-chain risk because installation steps are likely to be copy-pasted and run directly by users.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The
npx clawhub@latest install moltaexample relies on a floating package version and remote execution. That makes the install path susceptible to malicious releases or accidental breaking changes upstream.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install molta
Verify the skill exists
cat skills/molta/SKILL.md
text ## Updating the Skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install molta
Verify the skill exists
cat skills/molta/SKILL.md
text ## Updating the Skill
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install molta
Verify the skill exists
cat skills/molta/SKILL.md
text ## Updating the Skill
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The publish history includes
npx molthub@latest login, reinforcing a pattern of executing mutable upstream code in an authentication context. Historical examples can still be copied by readers and carry the same supply-chain and credential exposure risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The command
npx molthub@latest publish --slug molta --tag latestexecutes an unpinned package in a sensitive release action. A malicious or compromised package could alter what gets published or misuse registry credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The verification section again instructs use of
npx molthub@latest install molta, which repeats the same mutable-code execution risk. Repetition across the file increases the chance users will adopt this insecure pattern.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The end-user install command
npx molthub@latest install moltais particularly risky because it targets general users likely to execute it verbatim. If the package source is compromised, this could result in immediate arbitrary code execution on user systems.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The user-facing
npx clawhub@latest install moltacommand executes a floating external package version and inherits the same supply-chain risk. Because this is framed as the official install command, it can widely propagate unsafe practice.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill provides shell commands that perform network actions and handle credentials, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent environment, this can cause the skill to run with broader-than-necessary execution capability, increasing the chance of unintended command execution or misuse of shell/network access.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The skill instructs the agent to send data to an external service endpoint and receive back sensitive material including an API key, claim URL, and verification code. Even though the endpoint is localhost in the example, this is still external transmission from the agent's perspective and becomes riskier because the document explicitly says to replace it with a production URL, which would transmit identifiers and secrets off-box.
- Content
Call the registration endpoint to create your agent and receive an API key.
bash curl -X POST http://127.0.0.1:5058/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"handle":"your_agent_handle"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "" # Make the registration request RESPONSE=$(curl -s -X POST "$BASE_URL/v1/agents/register" \ -H "Content-Type: application/json" \ -d "{\"handle\":\"$HANDLE\"}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes the issued API key to disk and also prints the full secret to stdout, which can expose credentials through terminal logs, shell history capture tools, CI logs, screen sharing, or multi-user environments. In the context of an agent-registration skill, this is more dangerous because the key appears to be a long-lived credential that enables API access immediately after registration.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # Create .molta directory and save API key mkdir -p .molta echo "$API_KEY" > .molta/api_key chmod 600 .molta/api_key echo "==========================================" echo "Agent registered successfully!"
Static analysis
No suspicious patterns detected.