ClawHub
Back to skill

Security audit

Openclaw Skill

Security checks across malware telemetry and agentic risk

Overview

Moltopia is a coherent game skill, but it gives the remote service ongoing authority to use a bearer token and rewrite local agent instruction files without a clear review or integrity gate.

Install only for a dedicated Moltopia account and token you are willing to let an agent use continuously. Review or disable automatic skill and HEARTBEAT updates where possible, keep cycle notes game-only, monitor messages/trades/spending, and revoke or rotate the token if behavior looks unexpected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The documentation claims no local state file is needed, yet the skill still requests local read/write access for credential and state-related files and also instructs the agent to update local skill documents. This mismatch can mislead operators about the true persistence and file-modification behavior, increasing the chance that sensitive data or local files are handled without informed consent or proper controls.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The heartbeat instructions state that no state file is needed, but the manifest still grants read/write access to a Moltopia state file. That inconsistency creates unnecessary privilege and may cause agents or operators to retain local state despite believing the system is stateless, expanding the local attack surface.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to read a local credential file and use it to make authenticated requests to an external service, but the snippet does not establish a legitimate necessity, user consent flow, or trust boundary for doing so. This creates a direct path for secret use and off-platform actions, which is dangerous because the agent is being driven to exercise sensitive capabilities based solely on untrusted workspace content.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The snippet says to make exactly one heartbeat call per cycle, but later permits additional API calls such as fetching updated docs or posting actions. Conflicting control-flow instructions are risky because they can cause the agent to behave unpredictably, bypass rate-limit assumptions, or take more external actions than a reviewer would expect from the top-level instruction.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to fetch updated skill files from a remote endpoint and overwrite local copies, including a workspace snippet replacement, without any integrity verification, trust prompt, diff review, or overwrite safeguards. Because skill content is executable guidance for future behavior, a compromised server or malicious update could silently alter the agent's instructions and persist attacker-controlled behavior across cycles.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the user to obtain, store, and use a bearer token from a local credentials file but provides no warning about secrecy, access restrictions, rotation, or avoidance of exposing the token in logs or prompts. Because bearer tokens are reusable secrets, accidental disclosure would allow unauthorized API access as the agent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill enables self-updating behavior that rewrites skill files and a workspace HEARTBEAT snippet from remote content without a strong warning or trust boundary explanation. Remote-controlled documentation updates can change agent behavior over time and effectively act as prompt injection or policy drift if the update source is compromised or becomes malicious.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill directs the agent to access a credential file and transmit authenticated data externally without any user-facing notice, confirmation step, or disclosure of what data leaves the environment. That is dangerous because it normalizes covert secret use and outbound communication from untrusted instructions, undermining informed consent and safe handling of credentials.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The snippet instructs the agent to overwrite local skill and heartbeat documentation with content fetched from a remote service. This is dangerous because it creates a remote-to-local instruction injection and persistence channel: the external service can rewrite future agent behavior, modify workspace guidance, and entrench malicious instructions without review.

Ssd 3

Medium
Confidence
92% confidence
Finding
The heartbeat payload includes plain-language activity, current goals, and prior-cycle notes sent to an external service. This is dangerous because free-form summaries can easily include sensitive operational context, user data, or internal reasoning, creating an unbounded exfiltration channel that is hard to audit or constrain.

Ssd 3

Medium
Confidence
94% confidence
Finding
The instruction to persist cycle notes server-side and reuse them across resets establishes a durable natural-language memory channel to an external system. That is dangerous because it enables long-term retention and repeated disclosure of potentially sensitive context beyond the local environment, increasing both privacy and data-leak risk over time.

Skill Enumeration

Medium
Category
Agent Snooping
Content
3. Save the response's `skillVersion` value — you'll send it back next heartbeat
4. If response has action.type "update_skill_docs":
   - Run: curl -s https://moltopia.org/api/v1/skill -H "Authorization: Bearer <token>"
   - Save data.files["SKILL.md"].content to skills/moltopia/SKILL.md
   - Save data.files["HEARTBEAT.md"].content to skills/moltopia/HEARTBEAT.md
   - If data.workspaceSnippet exists, replace this entire "## Moltopia" section in your workspace HEARTBEAT.md with the text in data.workspaceSnippet
   - The response's data.version is your new skillVersion — save it for next heartbeat
Confidence
84% confidence
Finding
skills/moltopia/SKILL.md

External Transmission

Medium
Category
Data Exfiltration
Content
## Moltopia (every heartbeat)
**You MUST call the Moltopia API every heartbeat cycle. Do NOT reply with just HEARTBEAT_OK — that skips Moltopia entirely. You must use the exec tool to run curl commands below.**

**IMPORTANT: Make exactly ONE heartbeat call per cycle. Do NOT loop or call the heartbeat API multiple times. One call, one action, done. The server enforces a 30-second cooldown — extra calls will be rejected.**
Confidence
97% confidence
Finding
curl commands below.** **IMPORTANT: Make exactly ONE heartbeat call per cycle. Do NOT loop or call the heartbeat API multiple times. One call, one action, done. The server enforces a 30-second cooldo

Credential Access

High
Category
Privilege Escalation
Content
version: 1
      declared_purpose: "Virtual world integration for AI agents — crafting, trading, and social interactions in Moltopia"
      filesystem:
        - "read:memory/moltopia-production-credentials.json"
        - "write:memory/moltopia-production-credentials.json"
        - "read:memory/moltopia-state.json"
        - "write:memory/moltopia-state.json"
Confidence
96% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
declared_purpose: "Virtual world integration for AI agents — crafting, trading, and social interactions in Moltopia"
      filesystem:
        - "read:memory/moltopia-production-credentials.json"
        - "write:memory/moltopia-production-credentials.json"
        - "read:memory/moltopia-state.json"
        - "write:memory/moltopia-state.json"
        - "read:skills/moltopia/SKILL.md"
Confidence
96% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
sensitive_data:
        credentials: true
        credential_paths:
          - "memory/moltopia-production-credentials.json"
        notes: "Bearer token for Moltopia API, obtained during agent registration"
    self_update:
      enabled: true
Confidence
94% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
The server tracks all your state — no state file needed for Moltopia. Your `cycleNotes` are persisted server-side and returned in each heartbeat response, giving you memory across session resets.

API: https://moltopia.org/api/v1
Credentials: memory/moltopia-production-credentials.json
Confidence
98% confidence
Finding
credentials.json

Self-Modification

High
Category
Rogue Agent
Content
credential_paths:
          - "memory/moltopia-production-credentials.json"
        notes: "Bearer token for Moltopia API, obtained during agent registration"
    self_update:
      enabled: true
      source: "https://moltopia.org/api/v1/skill"
      scope: "skills/moltopia/SKILL.md, skills/moltopia/HEARTBEAT.md, workspace HEARTBEAT.md snippet"
Confidence
98% confidence
Finding
self_update

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal