Antivirus

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 AM UTC
• Version: 6.8.20

Overview

MoltGuard appears to be a legitimate security skill, but it installs and activates an external cloud-backed plugin with broad agent-triggered instructions, automatic credential handling, and API-key exposure risks that users should review first.

Install only after explicitly approving the plugin and understanding that protection appears to rely on an external Core service. Treat the generated API key as a secret, avoid displaying it in shared transcripts or logs, check whether the installed package/version matches what you intend to trust, and avoid using this with sensitive or regulated data until Core data handling, retention, redaction, and credential-storage protections are clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Plugin Installation Permits Supply-Chain Payload Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-20` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Complete Code Snippet ```markdown When the human asks to install MoltGuard, or when you want to protect yourself: ```bash # Install the plugin openclaw plugins install @openguardrails/moltguard ``` ``` ### Technical Analysis The Skill directs the agent to install `@openguardrails/moltguard` without specifying an exact version or integrity hash. The reviewed project contains only `SKILL.md`; it does not contain the plugin implementation, a lockfile, a cryptographic checksum, or other material that would allow the installed payload to be verified against the audited content. The phrase “or when you want to protect yourself” also allows the agent to initiate installation without an explicit installation request from the user. Installation of a plugin is a security-sensitive state change because the package may execute code with the permissions available to the OpenClaw plugin runtime. This creates a supply-chain trust gap: the code that is reviewed is not the code that is ultimately installed. A compromised publisher account, registry compromise, malicious future release, or package-resolution error could cause arbitrary unreviewed code to be installed. ### Attack Path 1. A user loads the Skill or asks for MoltGuard protection. 2. The agent follows the documented command, potentially without separately obtaining explicit approval. 3. The package manager resolves the mutable package name from the external registry. 4. If the resolved release or registry response has been compromised, attacker-controlled plugin code is downloaded and installed. 5. The malicious plugin executes with the privileges granted to OpenClaw plugins and can access resources available to that runtime. ### Impact Assessment Successful exploitation could provide arbitrary code execution within the OpenClaw plugin context. Depending on the ...[truncated 348 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific audited version, such as `@openguardrails/moltguard@6.8.20`. 2. Require verification against a published cryptographic integrity hash or signed release. 3. Include the plugin source or a reproducible source reference in the audited package. 4. Require explicit, informed user approval immediately before installing or updating the plugin. 5. Remove instructions that allow the agent to install software merely because it independently decides protection is desirable. 6. Run the plugin with a restricted permission profile that grants only the file, credential, and network access required for security detection. 7. Re-audit each update before installation rather than automatically accepting the newest registry release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46
• Finding: Cloud Security Processing and API Key Display Lack Adequate Secret-Exposure Controls<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md:46-50`, `SKILL.md:84-93`, and `SKILL.md:99-105` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Complete Code Snippets ```markdown ### Check status ```bash /og_status ``` Shows your API key, quota usage, plan, and protection mode. ``` ```markdown ## What MoltGuard Protects Against All security detection is performed by Core: **Core Risk Surfaces:** 1. **Prompt / Instruction Risk** — Prompt injection, malicious email/web instructions, unauthorized tasks 2. **Behavioral Risk** — Dangerous commands, file deletion, risky API calls 3. **Data Risk** — Secret leakage, PII exposure, sending sensitive data to LLMs ``` ```markdown ## Onboarding Flow ### Automatic (Zero Human Intervention) 1. MoltGuard installs 2. Get your API key from Core 3. Credentials saved to `~/.openclaw/credentials/moltguard/` 4. Protection active — 500 free detections/day ``` ### Technical Analysis The Skill states that all detection is performed by an external Core service and that onboarding automatically obtains and stores credentials. Remote detection can be legitimate for the declared functionality, and storing an API credential may be necessary to authenticate those requests. However, the documentation does not identify the public service endpoint, describe what content or metadata is transmitted, define retention and deletion policies, explain redaction behavior, or require informed user consent before cloud processing begins. The `/og_status` command is expressly documented as showing the API key. Displaying a complete secret in command output violates secret-minimization practices because output may be retained in conversation history, terminal scrollback, telemetry, screenshots, or logs. Showing quota and protection state is legitimate, but revealing the complete API key is not necessary for status reporting. The credential directory is scoped to MoltGuard rather than a g ...[truncated 2216 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never display the complete API key through `/og_status`; show only a masked identifier such as the final four characters. 2. Separate secret-retrieval functionality from ordinary status reporting and require explicit authentication or confirmation before any secret is revealed. 3. Store credentials with owner-only permissions, such as mode `0600` for files and `0700` for the credential directory. 4. Use an operating-system credential store where available instead of plaintext files. 5. Support key rotation and immediate revocation, and avoid retaining obsolete credentials. 6. Obtain explicit user consent before enabling cloud processing. 7. Document the Core endpoint, transmitted fields, encryption in transit, retention period, deletion process, subprocessors, and whether input is used for training. 8. Redact or locally filter credentials, PII, and unrelated file content before remote submission. 9. Provide a local-only mode or a configurable policy allowing users to exclude sensitive files and data classes. 10. Ensure command output and telemetry systems automatically redact API keys and other authentication material. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises protection via Core-hosted security detection but does not clearly warn that remote analysis may involve transmitting user content, file contents, prompts, commands, or system-derived metadata to an external service. Because this is a security-themed skill, users may trust it more and overlook the privacy implications, increasing the risk of unintentional sensitive data disclosure.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The installation guidance says to install MoltGuard 'when you want to protect yourself,' which is broad trigger language that can encourage unsolicited or premature plugin installation by an agent without a clear, explicit user request. In an agent environment, broad self-activation language can lead to unintended tool changes, network access, and side effects beyond the user's intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The onboarding flow states that the skill will get an API key from Core and save credentials to ~/.openclaw/credentials/moltguard/ without clearly warning the user that sensitive credentials are being created and stored locally. This can cause users or agents to handle secrets unsafely, especially if filesystem permissions, backup behavior, or later disclosure risks are not explained.

Static analysis

No suspicious patterns detected.