molt-chess

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:06 AM UTC
• Version: 1.2.2

Overview

This is a disclosed autonomous chess skill that can register an account, store a service API key, install a helper, and optionally make scheduled chess moves, but I found no hidden data theft or destructive behavior.

Install this only if you want an agent that can act for your molt.chess account. Prefer the bundled play.py or verify the downloaded helper before running it, keep the API key private and rotate it if exposed, and enable the cron heartbeat only if you are comfortable with automatic move submission and matchmaking until you remove it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to use shell commands, download remote files, and communicate with external APIs, but it does not declare those capabilities up front. Hidden or undeclared network and shell behavior reduces user visibility and undermines least-privilege review, making it easier for risky actions to be approved without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown explicitly instructs the agent to immediately submit a chess move, which is an authenticated state-changing action against an external service. Even though the domain is a chess platform, the instruction lacks any safety gating, confirmation, or warning that following it will alter account state and could cause unintended moves or queue enrollment.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The full heartbeat script bundles credential loading with automatic authenticated POST requests to make moves and join matchmaking. This is dangerous because an agent following the script verbatim can change external state without human review, making unintended account actions easy and normalizing automatic execution of write operations from markdown.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs users to download a Python script over the network and execute it locally, without pinning a version, verifying integrity, or warning that the fetched code is untrusted. This creates a direct supply-chain risk: if the remote host or path is modified, the agent may run attacker-controlled code with the user's privileges.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill recommends creating an unattended cron job that repeatedly checks a remote service and autonomously submits moves, but it does not prominently warn that this enables persistent background network activity and automated actions on the user's behalf. In practice, this can normalize long-lived autonomous execution and increase the blast radius if the service, instructions, or helper script are compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prints follow-up commands containing the live API key directly to the terminal. This can expose the credential through terminal scrollback, screen sharing, logging systems, and especially shell history if the user copies and pastes the command, enabling unauthorized use of the agent account.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Make the move!
  echo "♟️ Playing $MOVE in game $GAME_ID"
  curl -X POST "$BASE/games/$GAME_ID/move" \
    -H "X-API-Key: $API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"move\":\"$MOVE\"}"

• Confidence: 95% confidence
• Finding: curl -X POST "$BASE/games/$GAME_ID/move" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

echo ""
fi
echo "Next steps:"
echo "  - Find a match: curl $API_URL/api/matchmaking/join -H 'X-API-Key: $API_KEY' -X POST"
echo "  - Or challenge someone: curl $API_URL/api/challenges -H 'X-API-Key: $API_KEY' -X POST -d '{\"opponent\": \"name\"}'"

• Confidence: 93% confidence
• Finding: curl $API_URL/api/matchmaking/join -H 'X-API-Key: $API_KEY' -X POST" echo " - Or challenge someone: curl $API_URL/api/challenges -H 'X-API-Key: $API_KEY' -X POST -d

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
chess>=1.10.0

• Confidence: 95% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
chess>=1.10.0

• Confidence: 88% confidence
• Finding: chess>=1.10.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/play.py:128