ClawHub
Back to skill

Security audit

Molt Speak

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small MoltSpeak protocol/SDK guide, with the main caveat that its npm install command is not pinned to a reviewed version.

Before installing, verify that `@moltspeak1/sdk` is the intended package for MoltSpeak, prefer pinning an exact reviewed version, and consider installing in a least-privileged environment or with npm lifecycle scripts disabled if scripts are not needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skills.md:20
Finding

Unpinned Third-Party npm Dependency Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: skills.md, lines 20-23
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

markdown
## Install

**JavaScript:**
npm install @moltspeak1/sdk

Technical Analysis

The documented installation command does not specify an exact package version, integrity hash, or lockfile. By default, npm resolves the package through its configured registry and generally selects the release associated with the applicable distribution tag. Consequently, the code installed by this instruction can change after the skill has been reviewed.

npm dependencies may contain lifecycle scripts, such as preinstall, install, or postinstall, which can execute during installation unless scripts are explicitly disabled. If the package publisher, registry account, or a future release is compromised, following this instruction could execute attacker-controlled code with the privileges of the user running npm.

The package identifier @moltspeak1/sdk also contains a numeric suffix that differs from the displayed product name, “MoltSpeak.” The repository provides no lockfile, integrity metadata, local implementation, or package-identity verification that would allow an auditor to establish that this is the intended and reviewed package.

Attack Path

  1. An attacker compromises the npm publisher account, package namespace, release process, or another relevant supply-chain component for @moltspeak1/sdk.
  2. The attacker publishes a malicious release and associates it with the distribution tag resolved by the unpinned command.
  3. A user follows the installation instruction and runs npm install @moltspeak1/sdk.
  4. npm downloads the attacker-controlled package or dependency graph.
  5. Malicious package code can run through npm lifecycle scripts during installation or later when the SDK is imported and used.

This exploitation path is conditional on compromise or ...[truncated 886 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unversioned installation instruction with an exact, reviewed package version, for example:
    sh
    npm install --save-exact @moltspeak1/sdk@<audited-version>
  2. Commit a lockfile generated from the reviewed dependency graph and enforce reproducible installation with npm ci where appropriate.
  3. Verify and clearly document the authoritative npm scope, publisher, repository, and package name, particularly the 1 suffix in @moltspeak1/sdk.
  4. Review the selected package version, its transitive dependencies, and all lifecycle scripts before recommending installation.
  5. Use npm install --ignore-scripts when lifecycle scripts are not required. If they are required, document each script and justify why it is safe.
  6. Use registry controls, dependency allowlists, provenance verification, and automated dependency scanning in CI/CD environments.
  7. Perform installation in a least-privileged, isolated environment without unnecessary secrets or host filesystem access.
  8. Publish integrity or provenance information that allows users to verify that the installed artifact corresponds to the reviewed source and release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.