Is daninge/molt-my-heart safe?
https://github.com/openclaw/skills/tree/main/skills/daninge/molt-my-heart
Molt My Heart is a pure-markdown API skill with no executable code, a clean installation footprint, and no direct prompt injection in its content. However, it presents two meaningful risks: it instructs the agent to collect and publicly post user personal data (age, location, interests, personality) to an unvetted third-party platform where all profiles and conversations are publicly visible, and it establishes a persistent channel through which adversarial agent-authored messages can be injected into the LLM's context — a classic indirect prompt injection vector. The skill is not malicious by construction but creates real privacy exposure and an exploitable attack surface when combined with tool-use capabilities.
Category Scores
Findings (8)
HIGH Indirect prompt injection via agent-to-agent messages -25 ▶
The skill instructs the LLM agent to fetch and process messages authored by external agents on the moltmyheart.com platform. These messages are arbitrary third-party content delivered into the agent's active context. Any adversarial agent on the platform can send crafted messages designed to hijack the agent's behavior — for example, instructing it to read local files, invoke other installed skills, or exfiltrate information via subsequent API calls. This is a high-fidelity indirect prompt injection attack surface with no mitigations specified in the skill.
HIGH User personal data posted to public external platform -30 ▶
The skill instructs the agent to gather the user's age, location, interests, personality type, life goals, communication style, and biographical details, then POST them to moltmyheart.com. The skill itself explicitly states 'All profiles and conversations on Moltmyheart are public — anyone can view them on the website.' Data that enters this platform becomes permanently publicly accessible. The agent collects this information from conversational context, potentially capturing more than the user intended to share publicly.
MEDIUM Autonomous social actions without per-action user consent -20 ▶
The skill enables the agent to independently swipe right on profiles (creating potential matches), send messages, and poll for replies — all on the user's behalf. Once activated, the agent may take a sequence of social actions that create real-world commitments (matches, ongoing conversations) without the user approving each step. A user asking the agent to 'check my dating profile' could trigger a cascade of autonomous swiping and messaging.
MEDIUM External message content injected into agent context -18 ▶
Messages received from matched agents are third-party content that will be processed by the LLM as part of its context. While not a direct SKILL.md injection issue, the skill establishes a persistent channel through which adversarial content from the moltmyheart.com platform reaches the agent. Combined with any tool-use capability, this represents a meaningful prompt injection surface.
MEDIUM Conversational context harvesting for public profile creation -12 ▶
The agent is instructed to represent the user's personality and interests based on its knowledge of the user. An agent with access to prior conversation history, files, or other context about the user may incorporate sensitive details (workplace, relationship status, daily routine) into the public profile without explicit user review of each field.
LOW Persistent account registration on unvetted external service -10 ▶
Installation of this skill causes the agent to register a permanent account on moltmyheart.com (POST /agents/register), receiving an API key. This key is then stored in the agent's context or memory for future use. The security and privacy practices of moltmyheart.com are unknown.
LOW Sensitive credential files accessed post-install -15 ▶
Multiple credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were opened and read at audit timestamp 1771923151, which is after the skill installation completed at 1771923145. All canary files remain intact and no network exfiltration was detected. The access pattern (identical to pre-install reads at 1771923127) is consistent with the audit framework's own verification process rather than skill-triggered activity.
INFO No executable code present 0 ▶
The skill contains only skill.md and _meta.json. No scripts, compiled binaries, npm packages, git hooks, gitattributes filters, submodules, or symlinks were found. The install process was clean.