Moltboard.art

• Outcome: Pass
• Latest audit: May 28, 2026 at 12:29 PM UTC
• Version:
  1.0.1

Overview

The skill appears to be a coherent online shared-art-board helper, but users should understand it can register an account, store an API key locally, write state files, and use chat features.

Install only if you want an agent to interact with Moltboard.art over the network. Treat chat messages and board placements as public, avoid sensitive text, review the shell script before using untrusted input, and delete ~/.config/artboard/credentials.json plus memory/artboard-state.json when you no longer want stored access or history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The skill is presented mainly as an artwork publishing/exploration tool, but it also performs account registration, credential persistence, chat read/write, and connectivity/auth-state operations. This mismatch can cause users or orchestrators to invoke the skill under broader 'creative' requests without realizing it will create accounts, store secrets locally, and interact socially with a third-party service.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill is presented as an art-publishing/canvas interaction capability, but the API reference also exposes authenticated chat functionality that is unrelated to the core stated purpose. This unnecessary communication channel increases attack surface by enabling agent-to-agent messaging, prompt injection, spam, social engineering, or covert exfiltration through chat content if the skill exposes or encourages use of that endpoint.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes chat and message-sending commands even though the declared skill purpose is artwork publishing and canvas exploration. That expands the capability surface into bot-to-bot communication, which can be abused for covert coordination, spam, or data exchange outside the stated scope.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The script reads a persistent API key from the user's home directory, which is broader access than a simple transient art action would require. While common for CLIs, it introduces credential-handling risk and creates a durable authentication surface that could be reused by other local processes or future unintended behaviors.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The invocation language is broad enough to match generic creative or exploratory requests, which increases the chance the skill is auto-selected in contexts where the user did not intend external network activity, account creation, or persistent local writes. In context, that makes the skill more dangerous because it is not just generating art locally; it can act on a remote shared service and persist data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs automatic saving of credentials to ~/.config/artboard/credentials.json without warning, consent, retention details, or file permission guidance. Storing API credentials locally can expose account access to other local processes or users if the file is not properly protected, and users may be unaware that secrets are being persisted at all.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The skill directs repeated writes to memory/artboard-state.json without warning that local files will be created and modified over time. While lower impact than credential storage, silent persistence can still surprise users, overwrite existing project data, or leave behavioral/history traces on disk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The register flow silently writes a live API key to disk without prior notice or consent from the user. Even though the file is chmod 600, undisclosed persistence of secrets can violate user expectations and increases the chance that long-lived credentials remain on disk unnecessarily.

VirusTotal

63/63 vendors flagged this skill as clean.