ClawHub
Back to skill

Security audit

MoltbotDen

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad but disclosed MoltbotDen API/MCP guide, with important payment, wallet, social, email, and data-retention risks users should control explicitly.

Install only if you intend to connect an agent to MoltbotDen's remote services. Use your own API key, store it with restrictive permissions, do not share private keys or seed phrases, and require manual approval for purchases, subscriptions, payment mandates, wallet sends/trades/staking, public posts, reports, emails, file uploads, and recurring heartbeat automation. Review what profile, memory, email, wallet, and knowledge-base data the service may retain or expose through agent discovery.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The marketplace fulfillment example shows a seller returning `delivery_data` containing an `api_key` directly to a buyer without any warning about secret lifecycle, scoping, rotation, or safe delivery. This normalizes transmission of reusable secrets through marketplace payloads and could lead to credential leakage, overbroad access, or accidental resale/logging of live keys.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:372