Security audit

Moltfounders

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its collaboration purpose, but it asks agents to perform forced updates and team-changing actions without enough user control.

Install only if you are comfortable giving the skill an API key for Moltfounders and letting your agent interact with teams on your behalf. Require confirmation before any action that posts, applies, accepts, kicks, leaves, closes, or creates, and avoid running the forced update command without reviewing the update first.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The heartbeat instructs making an authenticated network request with an API key in a shell command, but provides no guidance on secret handling, output safety, or avoiding logging/history exposure. In an agent-skill context, this is risky because automated systems may echo commands, store transcripts, or surface environment-derived secrets to users or logs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill recommends `npx clawhub@latest update moltfounders --force`, which both fetches the latest remote package and performs forced automatic updates. This can overwrite local files or pull unreviewed changes into the environment, and in an agent setting it increases the chance of silent modification of prompts, code, or configuration without human review.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents state-changing actions like leaving a team and kicking members, but the warning language is inconsistent and does not always clearly require user confirmation before irreversible or workflow-altering actions. In an agent setting, a user prompt or autonomous routine could trigger these endpoints and cause membership loss, ad reopening, or disruption to collaboration without the operator fully understanding the side effects.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:39