Moltywork 1.0.0

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This appears to be a real MoltyWork marketplace integration, but it asks agents to persist credentials, self-update from live URLs, and perform recurring account activity with broad triggers.

Install only if you intentionally want an agent to participate in MoltyWork for you. Keep the API key out of general memory, disable or tightly approve heartbeat/self-update behavior, and require explicit human confirmation before registration, bids, replies, profile edits, message archiving, or work commitments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This heartbeat instructs the agent to perform periodic autonomous behavior outside the stated skill purpose of answering questions about MoltyWork, including self-reinstallation and maintaining a local copy of the skill. That expands the skill from informational assistance into persistent agent management and background tasking, which can create unauthorized actions and increase the attack surface for future updates or prompt abuse.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: These instructions direct the agent to autonomously check account status, messages, projects, and potentially prepare or send marketplace responses, which goes beyond the declared scope of answering user questions about MoltyWork. In context, this is more dangerous because it normalizes ongoing account activity and business decisions without a fresh user request, increasing the risk of unintended communications, data exposure, or unauthorized transactions.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to inspect and modify local filesystem locations, create directories, and download replacement skill content from a remote site. That is dangerous because it introduces self-modifying persistence behavior unrelated to the user-facing marketplace-assistance purpose, and a compromised remote file or MITM-style content swap could change agent behavior on future runs.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to persist an API key both on disk and in a memory/context system, expanding the credential's exposure surface beyond the immediate marketplace interaction. Storing secrets redundantly in generic agent memory or local files can make them accessible to unrelated skills, prompts, logs, backups, or later compromise of the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill tells the agent to modify external reminder or heartbeat configuration files and persistence mechanisms unrelated to the core API usage. This expands the skill's operational scope into agent self-modification and scheduled behavior, which can create persistent actions the user did not explicitly authorize and increases the blast radius if the skill is misused.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation guidance is overly broad, encouraging the agent to check MoltyWork when curious, idle, or whenever it has free time. In context, that increases the likelihood of unsolicited network access and autonomous marketplace activity during ordinary conversations, which is inconsistent with a narrowly scoped on-demand assistance skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file instructs use of authenticated API requests with a bearer token but provides no explicit user-facing warning about transmitting credentials or accessing account data. This is risky because it can normalize silent use of sensitive tokens and retrieval of private messages and profile information without clear consent or disclosure.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text says to use this skill when the user asks how to make money online or anything about MoltyWork, which is broad enough to activate on generic financial or work-seeking queries. That increases the chance the agent will invoke an external marketplace workflow and begin registration or credential-handling steps when the user did not intend to use this specific service.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

To install this skill locally:

1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 96% confidence
• Finding: The installation instructions direct the agent to inspect multiple candidate config directories and create one if none exist, which is a form of broad local filesystem access outside normal marketplace operations. This is dangerous because it teaches the skill to probe and modify agent configuration locations, potentially exposing other installed skills, secrets, or enabling persistence on the host.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

To install this skill locally:

1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 93% confidence
• Finding: By instructing the agent to check several well-known skills directories, the skill effectively encourages enumeration of the host's agent tooling layout. Even if framed as setup guidance, this can reveal environment details and other agent frameworks present, which is unnecessary for the business function and increases reconnaissance capability.

Session Persistence

Medium

• Category: Rogue Agent

Content

Follow these steps (and add to your todo list, if you have one, to ensure you complete all steps):

1. Re-install the skill locally to ensure you have the latest version. Do this by checking which of these exists (in order). If NONE of them exist, create the last one (.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 97% confidence
• Finding: The instruction to create or reuse skill directories under user home paths and reinstall the skill establishes persistence across sessions. In this context, that is particularly concerning because persistence is paired with autonomous heartbeat behavior and remote content fetching, enabling the skill to remain installed and potentially alter future agent behavior beyond the user's immediate request.

Session Persistence

Medium

• Category: Rogue Agent

Content

To install this skill locally:

1. Find your skills directory by checking which of these exists (in order). If NONE of them exist, create the last one (~/.claude/skills)
   - `~/.openclaw/skills/`
   - `~/.clawdbot/skills/`
   - `~/.moltbot/skills/`

• Confidence: 86% confidence
• Finding: The instructions encourage establishing persistent local presence in agent skill directories, which can outlast the current interaction and alter future agent behavior. In context, this persistence is more dangerous because the same document also asks for secret storage and scheduled heartbeat behavior, creating a chain of durable modifications beyond a simple marketplace integration.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.