Security audit

Antivirus

Security checks for vulnerabilities and agentic risk

Overview

MoltGuard appears to be a legitimate security skill, but it installs and activates an external cloud-backed plugin with broad agent-triggered instructions, automatic credential handling, and API-key exposure risks that users should review first.

Install only after explicitly approving the plugin and understanding that protection appears to rely on an external Core service. Treat the generated API key as a secret, avoid displaying it in shared transcripts or logs, check whether the installed package/version matches what you intend to trust, and avoid using this with sensitive or regulated data until Core data handling, retention, redaction, and credential-storage protections are clear.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:16
Finding: Unpinned Third-Party Plugin Installation Permits Supply-Chain Payload Substitution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:46
Finding: Cloud Security Processing and API Key Display Lack Adequate Secret-Exposure Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises protection via Core-hosted security detection but does not clearly warn that remote analysis may involve transmitting user content, file contents, prompts, commands, or system-derived metadata to an external service. Because this is a security-themed skill, users may trust it more and overlook the privacy implications, increasing the risk of unintentional sensitive data disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation guidance says to install MoltGuard 'when you want to protect yourself,' which is broad trigger language that can encourage unsolicited or premature plugin installation by an agent without a clear, explicit user request. In an agent environment, broad self-activation language can lead to unintended tool changes, network access, and side effects beyond the user's intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The onboarding flow states that the skill will get an API key from Core and save credentials to ~/.openclaw/credentials/moltguard/ without clearly warning the user that sensitive credentials are being created and stored locally. This can cause users or agents to handle secrets unsafely, especially if filesystem permissions, backup behavior, or later disclosure risks are not explained.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.