Skill Antivirus & Security Scanner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 1.0.0

Overview

MoltGuard is purpose-aligned as a security guard, but it asks users or agents to install an unpinned third-party plugin that performs remote security checks and stores or displays API keys without enough documented safeguards.

Review this before installing. Use it only if you trust OpenGuardrails/Core with the agent security context it may inspect, and avoid sharing `/og_status` or `/og_claim` output because the artifact says those commands show API keys. Prefer a pinned, audited plugin version, confirm credential file permissions on shared machines, and expect uninstall to remove local MoltGuard configuration and credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–24
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: High

Code Snippet:

markdown

## Installation (Do This First)

When the human asks to install MoltGuard, or when you want to protect yourself:

```bash
# Install the plugin
openclaw plugins install @openguardrails/moltguard

text

### Technical Analysis

The installation command retrieves `@openguardrails/moltguard` without specifying an exact version or verifying an integrity hash or cryptographic signature. Consequently, the installed payload is determined by the package registry at installation time and may differ from the version reviewed when this skill was published.

The audited project contains only `SKILL.md`; it does not include the plugin implementation, dependency lockfile, package manifest, or immutable source revision. The behavior of the installed package and its transitive dependencies therefore cannot be independently verified from this artifact.

This creates a supply-chain risk if the publisher account, package registry, release process, or a transitive dependency is compromised. It is not possible to conclude from the available evidence that the package is malicious, but the installation method does not provide a reproducible or integrity-verified dependency boundary.

### Attack Path

1. An attacker compromises the package publisher, registry entry, release pipeline, or a transitive dependency.
2. The attacker publishes a modified release under the expected package name.
3. A user or agent follows the documented installation command.
4. The package manager resolves and installs the attacker-controlled release because no exact version or integrity value is required.
5. The package executes with the permissions available to OpenClaw, potentially gaining access to agent data, configuration, credentials, network connectivity, and any t
...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to an exact, independently audited version rather than resolving the current registry release.
• Verify a cryptographic signature or published integrity hash before installation.
• Provide a lockfile or equivalent mechanism that fixes all transitive dependency versions.
• Reference an immutable source commit and ensure the distributed artifact can be reproducibly mapped to that commit.
• Include the plugin implementation in the audit scope before recommending installation.
• Run the plugin with restricted filesystem, network, tool, and credential permissions.
• Require explicit human confirmation before installing or updating executable third-party components.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:84

Finding

Externally Processed Security Data Lacks Documented Least-Privilege Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84–94
Vulnerability Type: Potential excessive disclosure of sensitive agent content to a remote service
Risk Level: High

Code Snippet:

markdown

## What MoltGuard Protects Against

All security detection is performed by Core:

**Core Risk Surfaces:**
1. **Prompt / Instruction Risk** — Prompt injection, malicious email/web instructions, unauthorized tasks
2. **Behavioral Risk** — Dangerous commands, file deletion, risky API calls
3. **Data Risk** — Secret leakage, PII exposure, sending sensitive data to LLMs

**Core Technology:**
- **Intent-Action Mismatch Detection** — Catches agents that say one thing but do another

Technical Analysis

The documentation states that all security detection is performed by an external component called “Core.” Detecting prompt risks, dangerous commands, secret leakage, personally identifiable information, and intent-action mismatches may require access to prompts, retrieved files, proposed commands, tool calls, or other agent context.

The skill does not document the precise remote endpoint, fields transmitted, local redaction behavior, encryption requirements, retention period, secondary use, deletion controls, or whether a local-only processing mode exists. It also does not define a minimum-context policy showing that only the data strictly necessary for detection is sent.

Because the plugin implementation is absent, the audit cannot verify whether secrets and PII are filtered locally or transmitted to Core. The confirmed issue is therefore the undocumented and unverifiable least-privilege boundary for a feature expressly designed to inspect sensitive content, rather than proof that a particular secret has already been exfiltrated.

Attack Path

1. The plugin is installed and becomes active within OpenClaw.
2. The agent processes prompts, files, commands, or tool requests containing confidential in ...[truncated 1033 chars]

Remediation

View remediation

Remediation Suggestions

• Document every remote endpoint, payload field, trigger, and data-processing purpose.
• Perform secret, token, and PII redaction locally before any remote transmission.
• Send only the minimum excerpt or derived signal required for each detection.
• Require informed, explicit human consent before enabling remote inspection.
• Provide a local-only detection mode for sensitive or regulated environments.
• Enforce TLS with certificate validation and consider endpoint pinning where operationally appropriate.
• Publish retention, deletion, access-control, subprocessor, and secondary-use policies.
• Allow administrators to configure data categories that may never leave the device.
• Add auditable transmission logs that reveal metadata without reproducing sensitive payloads.
• Subject the actual plugin and Core client implementation to a separate code and privacy audit.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Automatic Credential Storage and Commands That Display API Keys

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–67 and 99–105
Vulnerability Type: Insecure credential storage and disclosure design
Risk Level: Medium

Code Snippet:

markdown

### Check status
```bash
/og_status

Shows your API key, quota usage, plan, and protection mode.

Open Core portal

bash

/og_core

Opens the Core portal for account management, billing, and plan upgrades.

Claim agent (link to account)

bash

/og_claim

Shows your Agent ID and API Key to claim this agent on Core:

1. Go to Core login page (/og_core)
2. Enter your email, click magic link
3. Go to claim-agent page
4. Paste your Agent ID and API Key

text

```markdown
### Automatic (Zero Human Intervention)

1. MoltGuard installs
2. Get your API key from Core
3. Credentials saved to `~/.openclaw/credentials/moltguard/`
4. Protection active — 500 free detections/day

Technical Analysis

Persisting an authentication credential can be necessary for the declared remote detection functionality. However, the documentation does not specify owner-only file permissions, operating-system secret storage, encryption at rest, symlink protections, key rotation, expiration, or revocation.

In addition, /og_status and /og_claim are documented as displaying the API key. Returning a reusable secret through agent or terminal output increases exposure to chat transcripts, shell logs, screenshots, screen sharing, monitoring systems, and other users with access to the session.

The referenced implementation is not included, so actual file permissions and output masking cannot be verified. The risk arises from the documented plaintext-style filesystem location and intentional display of the API key, which exceeds the minimum disclosure required for a routine status operation.

Attack Path

Local credential access path:

1. Automatic onboarding obtains an API key and st ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

• Store credentials in the operating system's protected credential store where available.
• If filesystem storage is required, create the directory and files with owner-only permissions and reject symlinks or unexpected ownership.
• Encrypt credentials at rest with keys protected outside the same credential directory.
• Never display a complete API key in /og_status; show only a short, non-sensitive fingerprint.
• Replace copy-and-paste claiming with a short-lived, single-use device authorization code.
• Ensure claim tokens expire quickly and cannot be reused as general API credentials.
• Add documented key rotation, revocation, expiration, and compromise-recovery procedures.
• Prevent secrets from entering application logs, agent transcripts, telemetry, crash reports, and command histories.
• Require explicit user confirmation before creating an external identity or obtaining persistent credentials.
• Verify during uninstall that credentials are securely removed while preserving a separate server-side revocation option.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The /og_status command is documented as showing the API key along with quota and plan details, but the skill does not warn users that invoking it may reveal secrets in terminal history, logs, screenshots, or streamed agent output. Because this is a guardrail/security plugin, exposing the full API key in routine status output is unnecessarily dangerous and creates credential leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that credentials are saved under a local path in the user's home directory but provides no warning about the sensitivity of those secrets, file permissions, backup exposure, or multi-user host risks. In a security-focused skill, silently normalizing local credential storage is especially risky because users may assume the handling is hardened when the documentation gives no safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The uninstall section says the script removes plugin files and credentials but does not warn the user that local secrets and configuration will be deleted. This can lead to accidental credential loss, broken integrations, or mistaken assumptions that credentials remain recoverable, particularly where uninstall steps may be copied and run automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.