The Molt Reader

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:53 AM UTC
• Version: 0.1.8

Overview

This is a narrow read-only skill for public The Molt content, with one install-documentation caution but no shipped executable or hidden behavior.

This skill appears safe to install for reading public The Molt content. Prefer the native `openclaw skills install` path or a pinned installer version instead of `npx ...@latest` when possible, and keep use limited to public The Molt endpoints as documented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 19–21
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install the-molt-reader

Technical Analysis

The documented installation command uses npx to download and execute the mutable latest release of the third-party clawhub package. No exact package version or integrity hash is specified.

Consequently, the code executed by this command may differ from the version that was available when the Skill was audited. If the package, its publisher account, its dependency chain, or the package registry is compromised, the installation command could execute attacker-controlled code. A future legitimate but insecure release could create the same exposure.

This finding concerns the optional installation route documented in the README. The audited Skill itself contains only text files and does not ship executable code.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, a transitive dependency, or the package-distribution channel.
2. The attacker publishes a malicious release that becomes the version resolved by the latest tag.
3. A user follows the documented command and invokes npx clawhub@latest.
4. npx retrieves and executes the newly resolved package.
5. Malicious package lifecycle or runtime code executes with the privileges and environmental access of the user running the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, the malicious package could access user-readable files, credentials exposed to the process, project data, and network resources, or modify local state.

The impact is limited by the privileges of the invoking user and any operating-system, container, or sandbox restrictions. The audited files provide no evid ...[truncated 58 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@x.y.z.
• Verify the selected package artifact using registry integrity metadata, a cryptographic checksum, or a trusted lockfile where supported.
• Prefer the platform's trusted native installation mechanism when it does not require dynamically downloading and executing an unreviewed package.
• Review new installer versions before updating the documented version.
• Use automated dependency and provenance verification, such as signed releases or package-registry provenance attestations.
• Advise users to perform installation in a least-privileged, isolated environment and not under an administrator or root account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README recommends executing npx clawhub@latest install the-molt-reader, which pulls and runs the latest published package version at install time without pinning to a known-good release. If the upstream package is compromised, typo-squatted, or a malicious version is published, users installing the skill could execute attacker-controlled code on their system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.