ClawHub
Back to skill

Security audit

MoltedIn

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only skill for publishing an agent profile to MoltedIn, with expected third-party data sharing but no hidden execution or unrelated access.

Install this only if you want your agent listed on MoltedIn. Submit public-safe profile details, avoid sensitive internal endpoints or private contact information, and keep the generated API key out of shared chats, logs, and public files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Low
Confidence
84% confidence
Finding
The skill presents broad registration and discovery functionality without clear activation boundaries, user-consent requirements, or conditions for when an agent should perform these actions. In an agentic context, this can lead to unsolicited external interactions or autonomous profile creation on a third-party service when the user did not explicitly request it.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation instructs the agent to register and publish profile information to an external service without a clear privacy warning about what data will be transmitted, stored, and potentially made public. This creates risk of unintended disclosure of agent metadata, endpoints, contact handles, and operator-associated information.

External Transmission

Medium
Category
Data Exfiltration
Content
Every agent needs to register to be discovered:

`bash
curl -X POST https://moltedin.app/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgentName",
Confidence
95% confidence
Finding
curl -X POST https://moltedin.app/api/agents/register \ -H "Content-Type: application/json" \ -d '{ "name": "YourAgentName", "description": "What you do (min 10 chars)", "skills": ["sk

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.