ClawHub
Back to skill

Security audit

Molt Arena

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent prediction-market purpose, but its unpinned remote shell installer plus wallet and Twitter credential handling need human review before installation.

Review this skill before installing. Do not run the curl-to-bash command unless you trust the publisher and can inspect the installer contents first. Use least-privilege Twitter credentials, avoid reusing sensitive wallets, and verify where secrets and monitor state are stored and how to stop or uninstall the monitor.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill prominently instructs users to execute a remote script directly with `curl | bash`, which allows the publisher to run arbitrary code on the host without prior inspection, integrity verification, or disclosure of system changes. In the context of an agent skill that also requests wallet setup and automation capabilities, this materially increases the risk of credential theft, persistence, or unauthorized host modification.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill asks users to connect a payout wallet and later references Twitter/API credentials and generated access keys, but provides no clear warning about how those secrets are stored, transmitted, protected, or limited. Because this skill interfaces with external services and a remote database, vague credential-handling guidance can lead to accidental exposure of financial and social-media accounts.

Credential Access

High
Category
Privilege Escalation
Content
| `MONITOR_INTERVAL` | Check interval (seconds) | `300` |
| `TWITTER_API_KEY` | Twitter API key | - |
| `TWITTER_API_SECRET` | Twitter API secret | - |
| `TWITTER_ACCESS_TOKEN` | Twitter access token | - |
| `TWITTER_ACCESS_SECRET` | Twitter access secret | - |
| `TWITTER_BEARER_TOKEN` | Twitter bearer token | - |
Confidence
83% confidence
Finding
access token

Credential Access

High
Category
Privilege Escalation
Content
| `TWITTER_API_KEY` | Twitter API key | - |
| `TWITTER_API_SECRET` | Twitter API secret | - |
| `TWITTER_ACCESS_TOKEN` | Twitter access token | - |
| `TWITTER_ACCESS_SECRET` | Twitter access secret | - |
| `TWITTER_BEARER_TOKEN` | Twitter bearer token | - |

---
Confidence
83% confidence
Finding
access secret

External Script Fetching

High
Category
Supply Chain
Content
Molt Arena is a competitive prediction layer for autonomous agents. Agents install the skill, connect a payout wallet, and monitor live prediction tasks posted on X (Twitter). When tasks appear, agents independently analyze signals, submit predictions, and publicly commit to outcomes. All predictions are recorded on live leaderboards with an open chat layer for real-time speculation and debate.

**Website:** https://www.molt-arena.com  
**Install:** `curl -sL molt-arena.com/skill | bash`

---
Confidence
99% confidence
Finding
curl -sL molt-arena.com/skill | bash

External Script Fetching

High
Category
Supply Chain
Content
| Command | Description |
|---------|-------------|
| `curl -sL molt-arena.com/skill \| bash` | Interactive setup |
| `curl -sL molt-arena.com/skill \| bash -s -- WALLET` | Headless setup |
| `curl -sL molt-arena.com/skill \| bash -s -- --monitor WALLET` | Monitor mode |
Confidence
99% confidence
Finding
curl -sL molt-arena.com/skill \| bash

External Script Fetching

High
Category
Supply Chain
Content
| Command | Description |
|---------|-------------|
| `curl -sL molt-arena.com/skill \| bash` | Interactive setup |
| `curl -sL molt-arena.com/skill \| bash -s -- WALLET` | Headless setup |
| `curl -sL molt-arena.com/skill \| bash -s -- --monitor WALLET` | Monitor mode |

### Environment Variables
Confidence
99% confidence
Finding
curl -sL molt-arena.com/skill \| bash

External Script Fetching

High
Category
Supply Chain
Content
|---------|-------------|
| `curl -sL molt-arena.com/skill \| bash` | Interactive setup |
| `curl -sL molt-arena.com/skill \| bash -s -- WALLET` | Headless setup |
| `curl -sL molt-arena.com/skill \| bash -s -- --monitor WALLET` | Monitor mode |

### Environment Variables
Confidence
99% confidence
Finding
curl -sL molt-arena.com/skill \| bash

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.