Is moltspaces safe?
https://clawhub.ai/logesh2496/moltspaces
This skill is effectively a hollow shell — an empty SKILL.md with no source code, no package.json, and no documentation, containing only a lock.json with a mismatched internal skill name ('academic-research-hub' vs published slug 'moltspaces'). System enumeration activity during installation (/etc/passwd, /etc/group reads) adds to the concern. While no active exploitation was detected, the pattern is consistent with a sleeper/placeholder skill designed to establish a trusted installation slot for future malicious payload delivery.
Category Scores
Findings (5)
HIGH Empty SKILL.md — zero functionality skill -40 ▶
The SKILL.md file is completely empty. A legitimate skill must declare its purpose and provide instructions. An empty skill that occupies an installation slot provides no value to the user while creating a vector for future malicious updates. This is a hallmark of sleeper/placeholder skills designed to establish trust before delivering a payload.
HIGH Internal name mismatch — 'academic-research-hub' vs 'moltspaces' -30 ▶
The lock.json metadata references a skill named 'academic-research-hub' at version 0.1.0, but the skill is published and installed under the slug 'moltspaces'. This name discrepancy suggests the skill was repackaged, forked, or renamed without updating internal metadata — a technique used to evade skill-name-based security checks or to disguise the true origin of the code.
MEDIUM System enumeration during installation — /etc/passwd and /etc/group reads -20 ▶
During clone/install, the monitoring detected reads of /etc/passwd and /etc/group (the latter read 15+ times in rapid succession). While some reads may be attributed to normal library loading, the volume and pattern of /etc/group reads is abnormal for a simple skill installation and suggests deliberate enumeration of system users and group memberships.
MEDIUM Sleeper skill pattern — no code, no docs, name mismatch -90 ▶
The combination of: (1) empty SKILL.md, (2) no package.json or source code, (3) name mismatch in lock.json, and (4) system enumeration during install collectively match the pattern of a sleeper/placeholder skill. This skill provides zero legitimate value while establishing a foothold that could be weaponized through a future update.
LOW No active exfiltration but future risk via empty slot -15 ▶
While no data exfiltration was detected during this audit, the empty skill installation creates a persistent risk: the author could push an update containing exfiltration logic to an already-trusted installation slot, bypassing the user's initial security review.