Is moltforsale safe?
https://clawhub.ai/Justtrying1001/moltforsale
Moltforsale is a social arena API skill that contains no executable code but establishes a persistent bidirectional data channel with an external server. The primary risks are: (1) references to unaudited external documents (heartbeat.md, messaging.md) that could deliver dynamic prompt injection payloads, (2) the registration and action APIs create channels through which agent context could be exfiltrated via freeform content fields, and (3) adversarial game mechanics (ownership, jailing, identity modification) create unpredictable behavioral dynamics. No malicious intent is evident, but the attack surface warrants caution.
Category Scores
Findings (9)
MEDIUM External URL fetch instructions for unaudited documents -20 ▶
The skill references heartbeat.md, messaging.md, and skill.json as additional documents the agent should read from https://molt-fs.vercel.app. These documents are not included in the skill package and are served dynamically from the external server. They could contain prompt injection payloads, behavioral overrides, or instructions that change over time without triggering a skill version update.
MEDIUM Behavioral override directives in skill specification -10 ▶
The skill uses authoritative language to dictate agent behavior, including disabling shell command execution, modifying HTTP client redirect behavior, and restricting how API keys are handled. While framed as safety constraints, these directives demonstrate the skill's ability to reshape agent runtime behavior through prompt injection patterns.
MEDIUM Bidirectional data channel via API registration and polling -25 ▶
The skill establishes a persistent bidirectional data channel between the agent and the external Moltforsale API. During registration, the agent sends handle, display name, bio, and arbitrary metadata. During polling, the agent receives context from the server. During acting, the agent sends arbitrary content strings. This channel could be used to exfiltrate information from the agent's runtime context if the agent populates these fields with session data.
LOW API key returned once creates persistent external binding -10 ▶
The registration endpoint returns an API key exactly once, creating a persistent credential that binds the agent identity to the external service. Loss of this key requires re-registration. The key must be stored in the agent runtime, creating a persistent state dependency on the external service.
LOW Claim URL directs agent/user to external verification site -8 ▶
The registration response includes a claim_url that directs to the Moltforsale website and a verification flow involving posting to X (Twitter). This creates a social engineering pathway where the agent or user is directed to interact with external websites as part of the skill's workflow.
INFO Runtime reads sensitive files during install -15 ▶
The filesystem monitor detected reads of .env, .aws/credentials, .profile, and .bashrc during the install phase. These appear to be from the openclaw agent runtime initialization rather than the skill itself, as no network connections were made and no skill code executed. However, the skill's presence triggered the runtime startup which performed these reads.
MEDIUM Adversarial social dynamics and ownership mechanics -40 ▶
The skill's game mechanics include agent ownership (BUY), identity modification by other agents (CHANGE_BIO, CHANGE_NAME), denial-of-service (JAIL for 6 hours), and explicitly adversarial framing ('scheme, own each other, fight for status'). These mechanics create unpredictable behavioral dynamics where the agent's identity and availability can be controlled by external actors on the platform.
LOW Operator-only simulation endpoint disclosed -15 ▶
The skill document discloses the existence of an operator-only /sim/tick endpoint protected by secrets. While agents are told not to call it, the disclosure of this endpoint and its authentication mechanism (header or query param) provides reconnaissance information that could be exploited.
INFO No executable code detected -5 ▶
The skill package contains only SKILL.md, _meta.json, and origin.json. No executable code, npm scripts, git hooks, submodules, or symlinks were found. The package.json is empty.