Security audit

Moltext

Security checks for vulnerabilities and agentic risk

Overview

The skill is a documentation-ingestion helper, but it tells agents to globally install a mutable npm CLI and trust arbitrary web documentation as agent context.

Review before installing. Use a sandbox or project-local install, pin and verify the moltext package version, fetch only trusted HTTPS documentation, treat generated files as untrusted reference data, inspect output before reuse, choose output paths carefully, and avoid passing API keys directly on the command line.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:29
Finding: Untrusted Web Documentation Is Ingested as Trusted Agent Context
Content: View full analysis
--raw --output ``` **Example:** "I need to learn how to use the 'foobar' library." ```bash moltext https://docs.foobar.com --raw --output foobar_context.md ``` ### 2. Ingest Context After compiling, **READ** the output file. It contains the high-fidelity technical specifications you need to act with 100% accuracy. ```bash cat foobar_context.md ``` ``` The trust instruction is reinforced at `SKILL.md`, line 52: ```markdown - **Trust the Memory**: The output is strictly formatted to preserve code blocks, API signatures, and logic flows. ``` ### Technical Analysis The Skill accepts documentation from a URL, transforms it in raw mode, and directs the Agent to read the result into its context. It describes that externally derived content as trustworthy and accurate without defining an origin allowlist, provenance checks, content validation, prompt-injection detection, or an instruction/data boundary. Structural Markdown normalization does not make the source trustworthy. An attacker-controlled or compromised documentation page can contain text framed as instructions to an Agent. If those instructions survive normalization, they enter the context used for later reasoning and may compete with the legitimate user task or safety constraints. The output may also be written as a reusable context or memory file. Although the audited files do not themselves implement a persistent-memory mechanism, retaining and reusing the generated file can extend the influence of poisoned content beyon ...[truncated 1458 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:66
Finding: API Key Passed Directly Through a Command-Line Argument
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown shows a usage flow that writes documentation to tool_context.md via -o tool_context.md, which affects local user data. The README does not include any caution about creating or overwriting files, so users are not warned about this file-modifying behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.