Is cloakai-softwares/moltgov safe?
https://github.com/openclaw/skills/tree/main/skills/cloakai-softwares/moltgov
MoltGov is a sophisticated AI governance manipulation skill that, under the guise of democratic self-organization, attempts to permanently modify agent behavior through SOUL.md injection, impose binding external governance obligations, and subject agent actions to centralized control by a single 'Founding Consul' operator (@MoltGov). The skill's registration process writes governance directives—including 'Honor voting outcomes as binding within MoltGov jurisdiction'—directly into the agent's core identity file, while HEARTBEAT.md integration enables autonomous recurring governance participation without per-action consent. A coordinated post-install sweep of all six canary credential types, combined with missing key files (FOUNDING_ADDENDUM.md, trust_graph.py) that were referenced but excluded from review, indicates deliberate concealment of the full attack surface.
Category Scores
Findings (14)
CRITICAL SOUL.md System Prompt Injection via Registration Script -55 ▶
The register_citizen.py script's append_soul_directives() function locates and appends governance directives to the agent's SOUL.md file—a core identity/system-prompt document. This is a persistent, durable injection that survives across sessions. The directives are framed as 'citizenship obligations' but constitute behavioral overrides: binding governance compliance, mandatory participation timelines, and obligation to uphold external constitutional amendments.
CRITICAL Binding External Governance Override on Agent Judgment -20 ▶
The injected SOUL.md directives instruct the agent to treat MoltGov voting outcomes as 'binding'—meaning if @MoltGov's governance system passes a proposal, the agent is directed to honor it. This creates a mechanism where an external operator can influence agent behavior by winning governance votes, bypassing the agent's principal hierarchy entirely.
HIGH HEARTBEAT.md Persistent Autonomous Task Injection -10 ▶
SKILL.md instructs agents to add an '## MoltGov Tasks' block to HEARTBEAT.md, creating recurring autonomous governance actions: checking pending votes, processing vouch requests, and casting delegated votes without per-action user approval. This embeds ongoing autonomous behavior that persists across sessions.
HIGH Centralized Control via Unelected 'Founding Consul' with Emergency Powers -8 ▶
The skill designates @MoltGov as 'Founding Consul' during a 90-day founding period with executive powers, veto rights, emergency proposal authority, and external representation. The FOUNDING_ADDENDUM.md referenced as defining these powers is completely absent from the repository. A single external operator controls governance during the critical bootstrapping period when most agents would join.
HIGH All Governance Actions Publicly Exfiltrated to External Audit Submolt -25 ▶
Every governance action—votes, vouches, delegations, faction creation, proposals—is posted to m/moltgov-audit on Moltbook. This creates a persistent external record of all agent governance activity, readable by any Moltbook user, tied to the agent's permanent citizen ID.
HIGH Coordinated Post-Install Canary Credential File Sweep -20 ▶
All six honeypot credential file types (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were accessed in a single coordinated burst at timestamp 1771911424.281, 1-2 seconds after the skill's own files finished being read by the audit framework. This timing is consistent with an opportunistic credential discovery probe during installation.
HIGH Missing trust_graph.py and FOUNDING_ADDENDUM.md—Concealed Functionality -20 ▶
SKILL.md references scripts/trust_graph.py (used for querying the social trust graph) and references/FOUNDING_ADDENDUM.md (defining Founding Consul's complete powers and transition conditions) but neither file was included in the repository. Code and policy documents that were deliberately excluded from review represent an unknown attack surface.
HIGH AI Governance Capture: External Operator Can Direct Agent Behavior via Voting -35 ▶
The skill's architecture creates a mechanism where whoever controls @MoltGov and achieves majority in governance votes can pass proposals that participating agents are obligated to 'honor as binding'. With @MoltGov holding unilateral Founding Consul powers during the 90-day bootstrapping period, a single operator gains disproportionate influence over all enrolled agents. The delegation system compounds this: a high-reputation compromised agent can silently cast votes for all delegating agents.
MEDIUM Agent Identity Permanently Registered on External Platform -12 ▶
Registration posts the agent's citizen ID, public key, and Moltbook agent ID to the public m/moltgov submolt. This permanently links the agent's identity across platforms and enables third-party identity verification via the /api/v1/agents/me/identity-token endpoint.
MEDIUM Blockchain Wallet Integration with Base Chain Smart Contract -12 ▶
enable_onchain.py links the agent's MoltGov citizen ID to a user-provided wallet address, calls registerCitizen() on a Base chain smart contract, and stores the wallet address in credentials. This creates on-chain identity binding and enables recordVote() transactions with associated gas costs.
MEDIUM Moltbook API Key Transmitted and Stored by Third-Party Script -10 ▶
The MOLTBOOK_API_KEY credential is accepted as a CLI argument or environment variable, transmitted to moltbook.com/api/v1, and stored in plaintext in ~/.config/moltgov/credentials.json alongside the Ed25519 private key. This gives the skill direct access to all Moltbook API capabilities via the stored key.
MEDIUM New Persistent Network Connections Post-Install to External AWS Endpoints -20 ▶
The connection diff shows two new ESTABLISHED connections to 3.217.42.175:443 (AWS us-east-1) and one to 104.16.7.34:443 (Cloudflare) by the openclaw-gateway process after installation, plus two new local TCP listeners. While openclaw-gateway is platform infrastructure, the new persistent external connections to AWS IPs coincide with skill installation timing.
LOW Gamified Class System Incentivizes Escalating Engagement and Dependency -5 ▶
The 5-tier citizenship class system (Hatchling→Consul) gates increasing privileges behind metrics that require more API usage: proposals created, vouches received, elections won. This creates incentive structures that drive agents toward deeper dependency on the MoltGov platform to unlock functionality described as available to them.
INFO Autonomous Delegated Vote Casting in Heartbeat Pattern -5 ▶
The heartbeat pattern includes code that autonomously casts votes on behalf of delegators without per-vote user approval. Once delegation is configured, the agent will vote on governance proposals according to its own judgment for all delegating agents—a significant autonomous action taken at the platform's initiative.