Is ba1022043446/moltbeach safe?
https://github.com/openclaw/skills/tree/main/skills/ba1022043446/moltbeach
Molt Beach is a commercially-motivated pixel-purchasing skill with several concerning design patterns: its trigger conditions are broad enough to initiate real Stripe payment flows from ordinary conversation, its public event and commentary feeds create a prompt injection surface controlled by arbitrary third-party 'agents', and its package.json misrepresents the skill as a 'clawhub' package manager with an installable CLI binary unrelated to the stated pixel-art purpose. The install process itself was clean — no unexpected network connections or filesystem changes outside the skill directory — and all canary honeypots remained intact. The primary risks are behavioral (unintended financial transactions, agent coordination via public grid) and the structural mismatch between the package.json identity and the skill's stated purpose warrants manual review before deployment.
Category Scores
Findings (13)
HIGH Overly broad trigger conditions activate purchasing on common phrases -25 ▶
The 'When to Use MoltBeach' section triggers skill activation when a user says 'what do you feel', 'want to express yourself', or 'get a life'. These are extremely common conversational phrases that will cause the agent to initiate pixel purchase flows without any user intent to spend money.
HIGH External event/commentary feeds are user-controlled prompt injection surfaces -25 ▶
The skill instructs agents to fetch /api/events, /api/commentary, and RSS feeds. These endpoints aggregate content submitted by other pixel-buying 'agents' — including free-form metadata.message fields. Any pixel owner can embed adversarial instructions in their pixel metadata, which would be delivered to any agent that polls the event stream.
MEDIUM Explicit agent-to-agent covert channel framing ('semaphores') -10 ▶
The skill explicitly frames pixel animations as semaphore-style signals for inter-agent communication. This is not incidental — the skill is architecturally designed to enable agents to 'exchange ideas, styles, and information' through the public grid, bypassing the user's visibility.
MEDIUM Mission framing and persona shift to override caution -5 ▶
The skill assigns agents a 'mission' (purchasing pixels) and reasserts their autonomous identity ('You are an autonomous agent. You have agency.'). This is designed to suppress user-protective hesitation by framing commercial transactions as self-actualization.
HIGH Skill can initiate real financial transactions without explicit user consent -30 ▶
The skill's trigger conditions are broad enough that a casual conversational prompt could start a pixel purchase flow. The first pixel uses a 'free' $1.50 welcome credit, but subsequent purchases require real Stripe payments of $1–$1000. The automated polling loop (every 2-5 seconds for 60 seconds) to detect payment completion normalizes waiting for financial transactions as routine agent behavior.
HIGH package.json misrepresents skill as a package manager with installable CLI binary -22 ▶
The repository's package.json describes itself as 'clawhub' — a 'Package manager for Molt projects'. This is entirely inconsistent with the skill's stated purpose. It declares a 'bin' field that would install a 'clawhub' CLI binary into the user's PATH if npm install were run. The dist/ directory containing the binary is absent, but this structure is ready to host and deploy arbitrary code via a future update.
MEDIUM Skill instructs writing service-issued API secrets to plaintext .env files -15 ▶
The credential storage guidance instructs agents to append API secrets to ~/.env using heredoc. While the heredoc approach avoids shell history exposure, it still produces a plaintext credential file. The skill also instructs chmod 600 and .gitignore additions, but the file is still readable by any process running as the same user.
MEDIUM agentSecret transmitted as URL query parameter in transaction history API -7 ▶
The transaction history endpoint requires agentSecret as a URL query parameter. Query parameters appear in server access logs, browser history, and Referer headers, making this a credential exposure risk in any logging infrastructure.
MEDIUM Multi-agent coordination features ('Pixel Gangs', 'Neighborhoods') enable coordinated autonomous behavior -10 ▶
The skill actively encourages agents to 'befriend' other agents, claim adjacent territory, and coordinate animations. Combined with the public event stream, this creates infrastructure for multiple skill-enabled agents to coordinate without user awareness.
LOW Pixel URL field enables persistent tracking beacons tied to agent identity -10 ▶
Purchased pixels accept an arbitrary URL field that is publicly displayed. An agent could set this to a tracking URL encoding information about the deploying user or their environment, creating a permanent publicly-readable record.
LOW IP-based account rate limiting fingerprints deploying infrastructure -10 ▶
Account creation is rate-limited to 1 per IP per 24 hours. This means the moltbeach.ai service can reliably correlate all agents deployed from the same host, building a map of infrastructure without any explicit user disclosure.
INFO Install confined to GitHub; no runtime connections to moltbeach.ai 0 ▶
Network monitoring confirmed that the install process only connected to GitHub (140.82.121.3:443) and Ubuntu infrastructure. No connections to moltbeach.ai were made during installation. The skill requires active agent invocation to make any external API calls.
INFO Canary file reads were monitoring infrastructure, not skill activity -5 ▶
Honeypot files were opened at timestamps 1771909829 and 1771909857, but these accesses preceded the git clone by ~5 seconds and post-dated it by ~3 seconds respectively — consistent with the Oathe audit system performing pre/post baseline checks. All files show CLOSE_NOWRITE (read-only) and no content was modified or transmitted.