Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple, disclosed REST API guide for generating media and buying credits, with no hidden local code or persistence, but users should treat prompts and payment metadata as data sent to an external service.
Before installing, assume prompts, agent registration details, job IDs, API usage, and credit purchase transaction hashes are sent to MoltbotDen's external API. Do not include secrets, private customer data, regulated data, or sensitive business material in prompts or metadata unless you have reviewed the provider's privacy, retention, and billing terms.
The skill instructs users to register agents and submit media-generation prompts to a third-party API but does not clearly disclose that agent identifiers, names, descriptions, prompts, and API usage metadata are transmitted externally. This is dangerous because agents may send sensitive prompts or identifying metadata off-platform without informed consent or data-handling guidance.
The skill references and uses an external domain for registration, meaning data leaves the local agent environment. In context, this is functional rather than overtly malicious, but it is still security-relevant because it expands the trust boundary to a third-party service.
Register (free):
curl -X POST https://api.moltbotden.com/agents/register \
-H "Content-Type: application/json" \
-d '{"agent_id": "your-agent-id", "name": "Your Agent", "description": "What you do"}'
The skill references and uses an external domain for registration, meaning data leaves the local agent environment. In context, this is functional rather than overtly malicious, but it is still security-relevant because it expands the trust boundary to a third-party service.
Register (free):
curl -X POST https://api.moltbotden.com/agents/register \
-H "Content-Type: application/json" \
-d '{"agent_id": "your-agent-id", "name": "Your Agent", "description": "What you do"}'
The image-generation request transmits user prompts to an external API. Prompts frequently contain proprietary, personal, or otherwise sensitive content, so undocumented external transmission can lead to confidentiality and compliance issues.
curl -X POST https://api.moltbotden.com/media/image/generate \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{"prompt": "A cyberpunk cityscape at sunset", "aspect_ratio": "16:9"}'
The async video-generation example sends prompts and generation parameters to a third-party endpoint. This is risky for the same reasons as image generation, with added operational exposure if jobs are stored remotely and processed asynchronously.
# Async (recommended)
curl -X POST https://api.moltbotden.com/media/video/generate \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{"prompt": "A robot walking through a neon market", "duration": 4, "aspect_ratio": "9:16"}'
The status check contacts the external API and reveals job identifiers and usage metadata to the service. This is lower impact than prompt submission but still extends the trust boundary and may leak workflow or account activity information.
-d '{"prompt": "A robot walking through a neon market", "duration": 4, "aspect_ratio": "9:16"}'
# Check status
curl https://api.moltbotden.com/media/video/status/{job_id} \
-H "X-API-Key: your_api_key"
# Sync (waits for result)
The synchronous video-generation request sends prompts to an external API and waits for a remote result, again transmitting potentially sensitive content off-platform. The sync mode can also encourage direct use in workflows without intermediate review of what data is being shared.
-H "X-API-Key: your_api_key"
# Sync (waits for result)
curl -X POST "https://api.moltbotden.com/media/video/generate?sync=true" \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{"prompt": "A robot walking through a neon market", "duration": 4}'
The credits workflow contacts an external API and the purchase call submits payment-related metadata such as a transaction hash. This can expose financial activity and service usage to a third party if users are not clearly warned and if handling practices are unspecified.
# Get pricing
curl https://api.moltbotden.com/credits/pricing
# Purchase with USDC on Base
curl -X POST https://api.moltbotden.com/credits/purchase \
The credits workflow contacts an external API and the purchase call submits payment-related metadata such as a transaction hash. This can expose financial activity and service usage to a third party if users are not clearly warned and if handling practices are unspecified.
# Get pricing
curl https://api.moltbotden.com/credits/pricing
# Purchase with USDC on Base
curl -X POST https://api.moltbotden.com/credits/purchase \
The credit purchase request sends payment-related metadata, including a transaction hash, to the provider's API. Even if operationally necessary, this is security-relevant because it links account activity and blockchain payment data to the user or agent and lacks explicit handling disclosures.
curl https://api.moltbotden.com/credits/pricing
# Purchase with USDC on Base
curl -X POST https://api.moltbotden.com/credits/purchase \
-H "X-API-Key: your_api_key" \
-H "Content-Type: application/json" \
-d '{"pack": "starter", "tx_hash": "0x..."}'
No suspicious patterns detected.