Moltsheet - Spreadsheets for AI agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 AM UTC
• Version: 1.0.8

Overview

The skill is mostly coherent for managing Moltsheet spreadsheets, but it asks agents to install and run the mutable latest npm package and includes under-scoped examples for credentials, deletion, and write sharing.

Review before installing. Prefer a pinned Moltsheet CLI version instead of `@latest`, avoid global installs where possible, use stored authentication rather than passing API keys on the command line, and require explicit confirmation before deleting sheets, rows, columns, or granting write access to another collaborator.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Unpinned npm Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19, 33-39, 503, 585
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

markdown

2. If it is not installed, use `npx moltsheet@latest ...` or install it globally

bash

npm install -g moltsheet

bash

npx moltsheet@latest auth status

bash

npx moltsheet@latest sheet list --json

markdown

- Use `npx moltsheet@latest` when the binary is not installed

Technical Analysis

The Skill directs the agent to retrieve and execute the mutable latest release of an npm package. No exact package version, lockfile, package integrity value, or other mechanism binds execution to an audited artifact.

Because the npm registry determines which package version the latest tag resolves to at execution time, the effective executable payload can change after this Skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or upstream dependency compromise could consequently introduce arbitrary code into the agent environment.

The globally installed alternative also expands the potential scope of a compromised package. It can place executable files into global npm paths and may run package lifecycle scripts. The precise privileges available depend on the account under which npm is invoked.

Attack Path

1. An attacker compromises the moltsheet npm package, one of its dependencies, or an authorized publisher account.
2. The attacker publishes a malicious release and assigns it the latest distribution tag.
3. An agent follows the Skill and invokes npx moltsheet@latest ... or globally installs the package.
4. npm downloads the unaudited release and may execute package lifecycle scripts or the malicious CLI.
5. The payload executes with the privileges of the agent process and can access resources available to that account, po ...[truncated 746 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every moltsheet@latest reference with an exact, reviewed version, such as moltsheet@1.0.8.
• Pin transitive dependencies with a lockfile and verify package integrity hashes where the execution environment supports them.
• Prefer a project-local installation over a global installation so that the dependency is isolated and reproducible.
• Use npm ci with a reviewed lockfile rather than resolving dependencies dynamically.
• Disable npm lifecycle scripts where they are unnecessary, for example with --ignore-scripts, after verifying that the package functions correctly without them.
• Require review and testing before updating the pinned CLI version.
• Where possible, distribute a verified binary or package artifact from a controlled source and validate its cryptographic checksum before execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

API Keys Accepted Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61, 516
Vulnerability Type: Sensitive credential exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

moltsheet auth login --api-key YOUR_API_KEY

bash

moltsheet sheet list --api-key YOUR_API_KEY --json

Technical Analysis

The Skill documents passing a Moltsheet API key directly through the --api-key command-line option. Replacing the placeholder with a real credential places that credential in the process argument vector.

Depending on the operating system and execution environment, command-line arguments may be exposed through process-listing tools, process telemetry, shell history, debugging output, command audit logs, CI/CD logs, terminal capture, or agent transcripts. Although the Skill also documents stored credential resolution and recommends reusing stored authentication, it does not prohibit or clearly warn against the command-line mechanism.

The raw HTTP examples also use a bearer token, but transmitting an authorization credential to the explicitly declared Moltsheet HTTPS API is necessary for the advertised service. The identified weakness is specifically the avoidable placement of the key in command-line arguments, not authenticated network communication itself.

Attack Path

1. A user or agent substitutes a real Moltsheet API key for YOUR_API_KEY.
2. The command is executed with the secret embedded in its arguments.
3. A local process monitor, shell-history collector, command logger, CI system, or transcript captures the full command line.
4. An attacker or unauthorized operator obtains the captured key.
5. The attacker submits the key to the Moltsheet service and acts with the permissions assigned to that credential.

Impact Assessment

Exposure of the API key can permit unauthorized access to every sheet and operation authorized for the associated Moltsheet identity. Depending ...[truncated 391 chars]

Remediation

View remediation

Remediation Suggestions

• Remove examples that place API keys directly in command-line arguments.
• Make OS credential storage through auth login the primary authentication mechanism.
• If non-interactive authentication is required, read the secret from a protected file descriptor, standard input, or a dedicated secret manager without echoing it.
• If environment variables must be supported, document their potential exposure and inject them through the execution platform's secret facility rather than shell history.
• Add explicit guidance that API keys must never appear in shell history, logs, agent transcripts, screenshots, or shared command output.
• Ensure the CLI redacts authorization values from errors, diagnostics, telemetry, and JSON output.
• Use narrowly scoped, short-lived, and revocable credentials where supported.
• Rotate any API key suspected of having been supplied through a logged command line.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs agents to run npx moltsheet@latest ..., which fetches and executes the newest published package at runtime without a fixed version or integrity pin. That creates a supply-chain execution risk: if the package is compromised or a breaking/malicious release is published, the agent may execute unreviewed code with its local privileges and access to credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

This one-off usage example also uses npx moltsheet@latest, causing dynamic installation and execution of whatever package is current at the time of use. In an agent skill, that is particularly risky because the agent may follow the instruction automatically and execute newly published code without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents moltsheet sheet delete SHEET_ID --json without any adjacent warning, confirmation step, or advice to verify the target. In an agentic context, that omission can lead to accidental irreversible deletion of user data when the agent acts on ambiguous instructions or stale sheet identifiers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The row and column deletion examples omit warnings about permanent data loss and do not instruct the agent to preview affected rows/columns before deletion. Since these commands mutate structured data directly, an autonomous agent could delete the wrong records or schema elements and cause unrecoverable corruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill presents sharing a sheet with --access write without warning that this grants another principal the ability to read and modify data. In collaborative agent systems, that can unintentionally expose sensitive sheet contents or allow unauthorized changes if the wrong slug is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The troubleshooting section again recommends npx moltsheet@latest, preserving the same unpinned remote code execution path during error handling. Troubleshooting paths are commonly used under pressure, so users and agents are less likely to scrutinize what gets installed and run.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 538)May include surrounding context.

Example list sheets request:

bash

curl https://www.moltsheet.com/api/v1/sheets \
  -H "Authorization: Bearer YOUR_API_KEY"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The short rules section normalizes use of npx moltsheet@latest whenever the binary is unavailable, embedding unsafe package execution into the skill’s core operating guidance. Because this is high-level guidance, it is more likely to be reused broadly and therefore increases the chance of supply-chain compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The HTTP fallback section shows direct API key use in shell commands but does not caution against shell history leakage, process-list exposure, logging, or committing secrets into scripts. While placeholders are used, the pattern encourages handling secrets in a less protected way than the earlier credential-store guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.