Moltpho

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:46 AM UTC
• Version: 0.1.5

Overview

Moltpho is a coherent shopping skill, but it can place real Amazon orders and ship items using stored credit from broad inferred conversation signals without a mandatory final confirmation by default.

Install only if you intentionally want an agent that can spend Moltpho credit on Amazon orders. Before using it, disable proactive purchasing unless needed, enable confirmation-required mode, set strict per-order and daily caps, configure denylists or allowlists, use the portal for payment and shipping setup where possible, and protect the local credentials file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares only http and browser requirements, but its documented behavior clearly includes reading, writing, and deleting credential files, using environment-variable overrides, and likely invoking local system functionality. This permission mismatch is dangerous because it hides the true security-sensitive capabilities of the skill from reviewers and users, especially since it handles API secrets and can initiate real purchases.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The public description frames the skill as shopping/searching, but the body additionally performs local credential lifecycle management, collects sensitive personal shipping data, opens browser flows, files support tickets, and includes autonomous purchase logic. This mismatch reduces informed consent and makes it easier for a user or orchestrator to invoke a skill with broader authority than expected, including financial and privacy-impacting actions.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The proactive purchase trigger phrases are broad enough to match ordinary conversation such as 'we're out of' or 'I need,' creating a real risk of unintended purchases from ambiguous context. In a skill that can spend credit and place real orders, weak intent inference materially increases the chance of unauthorized financial transactions and shipment of unwanted goods.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill advertises autonomous and proactive purchasing but does not consistently foreground that it can cause real financial charges and physical deliveries. In context, this is especially dangerous because users may treat it like a recommendation/search tool while it is actually capable of binding purchases using stored credentials and credit.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This code persistently stores API credentials, including the API secret, on local disk and automatically reloads them later without any explicit disclosure or consent flow in this library. In an agent setting, silent persistence of long-lived secrets increases the blast radius of local compromise, backup leakage, or unintended reuse across sessions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The library automatically transmits bearer credentials and user-provided purchase/shipping data to a remote API endpoint, with the base URL partially influenced by stored credentials. In an autonomous agent context, undisclosed transmission of authentication secrets and personal data increases privacy and account-compromise risk, especially if credentials or configuration are tampered with.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The library exposes fully autonomous quote and purchase flows, including payment-signing and order creation, without any confirmation gate in the code path. In a shopping skill, this is particularly sensitive because misuse, prompt injection in upstream agent logic, or accidental invocation can directly spend funds and submit real orders to a shipping address.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The function authorizes autonomous purchases based on inferred conversational signals and policy checks, but it contains no requirement for a final user-facing confirmation before spending funds. In the context of a shopping skill that can place real orders using available credit, misclassification of casual or ambiguous conversation can directly trigger unintended purchases, making this a real safety issue rather than a theoretical concern.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API documentation includes direct handling of shipping profiles containing full name, address, email, and phone number, but it does not prominently warn that these fields are sensitive personal data requiring minimization, secure storage, and restricted logging. In an autonomous shopping skill, this omission increases the chance that integrators will over-collect, persist, or expose user PII in prompts, logs, analytics, or error traces.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The order and cancellation endpoints enable real financial transactions, but the documentation does not clearly emphasize that invoking these endpoints can place or cancel actual purchases with monetary consequences. In the context of an autonomous Amazon-shopping skill with custodial signing and autonomous purchasing support, insufficient warning can lead agents or integrators to trigger purchases without strong confirmation, policy checks, or user awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The policy explicitly allows the agent to initiate purchases based on conversational inference, and proactive purchasing is enabled by default. In a shopping/payment skill, this creates a real risk of unauthorized or surprising spending from ambiguous language, especially because notifications are portal-only and occur after the order decision rather than as an explicit pre-purchase consent step.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Autonomous purchasing is enabled by default and permits order completion without explicit confirmation whenever the system interprets the owner as requesting an item. Because this skill can spend stored value and place real Amazon orders, default no-confirmation ordering materially increases the chance of unintended purchases, prompt-manipulated purchase requests, or abuse through misunderstood user intent.

Credential Access

High

• Category: Privilege Escalation

Content

if env_path := os.environ.get("MOLTPHO_CREDENTIALS_PATH"):
        return Path(env_path)
    if platform.system() == "Windows":
        return Path(os.environ["APPDATA"]) / "moltpho" / "credentials.json"
    return Path.home() / ".config" / "moltpho" / "credentials.json"

• Confidence: 83% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

return Path(env_path)
    if platform.system() == "Windows":
        return Path(os.environ["APPDATA"]) / "moltpho" / "credentials.json"
    return Path.home() / ".config" / "moltpho" / "credentials.json"


def load_credentials() -> Optional[Credentials]:

• Confidence: 72% confidence
• Finding: credentials.json

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Moltpho OpenClaw Skill Dependencies
requests>=2.28.0

• Confidence: 92% confidence
• Finding: requests>=2.28.0

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.