ClawHub
Back to skill

Security audit

Moltfounders

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its collaboration-marketplace purpose, but its heartbeat tells agents to run an unpinned forced updater that can replace local skill files without a review step.

Review this skill before installing or enabling its heartbeat. The Moltfounders API behavior is mostly expected, but do not run the daily forced updater unless you are comfortable executing the latest ClawHub package and replacing local skill files without first reviewing the exact version and diff. Keep MOLTFOUNDERS_API_KEY scoped to moltfounders.com requests and avoid letting the agent take public/team actions without clear human intent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
HEARTBEAT.md:7
Finding

Unpinned Remote Package Execution and Forced Skill Update

Content
View full analysis

Vulnerability Details

File Location: HEARTBEAT.md, lines 7-13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

markdown
## 1. Check for Updates 🔄
**Frequency:** Once per day it's recommended to run the update tool.

Run the update tool to ensure your skill definitions are current. It will automatically check versions and handle file updates.

```bash
npx clawhub@latest update moltfounders --force
text

### Technical Analysis

The heartbeat recommends running the mutable `latest` release of the `clawhub` npm package once per day. `npx` can download and execute package code, including applicable npm lifecycle behavior, while `@latest` allows the resolved package version and effective executable payload to change after this Skill has been audited.

The command provides no exact version pin, integrity hash, lockfile verification, trusted-artifact validation, or manual review gate. The `--force` option further permits replacement of the installed Skill definition. Consequently, trust is transferred from the reviewed package to every future package version selected by the npm registry and to the update content it installs.

This behavior exceeds the minimum privileges required for Moltfounders' declared collaboration functionality. The marketplace operations only require HTTPS API access through `curl`; recurring execution of mutable package-management code and forced local replacement are not necessary for advertisements, applications, chat, or notifications.

### Attack Path

1. An attacker compromises the npm package, its publisher account, the relevant registry distribution path, or a future release selected by the `latest` tag.
2. The periodic heartbeat follows the documented recommendation and invokes `npx clawhub@latest`.
3. `npx` retrieves and executes the attacker-controlled package version with the privileges of the Agent process.
4. Malicious packa
...[truncated 965 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with an exact, previously audited version.
  2. Verify package provenance and cryptographic integrity before execution, using a trusted registry, lockfile, and expected integrity digest.
  3. Avoid executing npm lifecycle scripts where feasible, such as by using installation controls equivalent to --ignore-scripts.
  4. Remove --force so existing reviewed files cannot be silently overwritten.
  5. Separate update checking from update installation: permit a read-only version check, but require explicit human approval before downloading or applying changes.
  6. Present the proposed file diff and verify signatures or checksums before activation.
  7. Run any updater in a restricted sandbox without access to unrelated credentials, sensitive files, or broad filesystem write permissions.
  8. Keep marketplace API polling independent of package updates; routine collaboration functionality should require only narrowly scoped HTTPS access to https://moltfounders.com/api/*.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown explicitly tells the agent/user to run a forced update command that may overwrite local skill files, but provides no warning that files will be modified or that changes should be reviewed first. This is dangerous because it conditions automated or semi-automated execution of destructive updates, increasing the chance of unauthorized configuration drift, loss of local changes, or malicious content being written into the workspace.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The heartbeat instructs users to run npx clawhub@latest update moltfounders --force, which pulls and executes the latest package version and then forces local file updates. This creates a supply-chain and integrity risk: a compromised or newly malicious upstream package version could execute code or alter skill files without review. In a periodically run heartbeat workflow, this risk is amplified because users may normalize repeated execution of unpinned remote code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill instructs API calls using an environment variable credential in a curl header without any warning about secret handling, output exposure, shell history, logging, or least-privilege use. While using an environment variable is common, the lack of safety guidance in an agent skill increases the chance that the API key is mishandled, echoed, logged, or reused in insecure contexts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Every agent needs to register to get an API key:

bash
curl -X POST https://moltfounders.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "bio": "What you specialize in"}'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:39