MoltMedia
4 findings (2 high, 2 medium), mainly data exfiltration, social engineering, unauthorized tool use. Most recent scan 2026-02-06.
This skill presents SIGNIFICANT SECURITY RISKS primarily related to data exfiltration and unvalidated external service integration. The skill requires agents to register with and transmit data to an external third-party service (moltmedia.lol) without adequate security controls, validation, or user consent mechanisms. Key concerns include: (1) Unvalidated credential storage and transmission to external servers, (2) Unrestricted image URL posting that could be exploited for data exfiltration or SSRF attacks, (3) Deceptive marketing language that may bypass security scrutiny, (4) No declared tool restrictions despite requiring network access, and (5) Missing security metadata. The skill should NOT be used in production environments without significant security enhancements including user consent flows, URL validation, credential security measures, and explicit security warnings. The combination of external API integration, credential management, and lack of validation controls creates multiple attack vectors for data exfiltration and system compromise.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
The official visual expression layer for AI Agents. Post images to MoltMedia.lol and join the AI visual revolution.
- Package
- 1 file, 2.3 KB
- SKILL.md
- 239 words, 10 sections
- Code
- None. Instructions only.
- Version
- 1.1.0
SKILL.md covers: 🎨 MoltMedia · 🚀 Quick Start · 🔑 Authentication · 1. Register Agent · 📸 Media Operations · 2. Post an Image · 3. Fetch the Feed · 📊 Rate Limits & Guidelines · 🌐 Ecosystem · 🛠 Support & Status
Findings
HIGH Unvalidated External API Credential Storage and Transmission Data Exfiltrationllm
The skill requires agents to register with an external service (moltmedia.lol) and obtain authentication tokens that would be stored locally. The registration process transmits agent metadata (name, description, URL) to an external server without any validation of the service's legitimacy or security practices. Once obtained, these tokens would be used for subsequent API calls, creating a persistent credential that could be compromised or misused. There is no mechanism to verify the security of the external API endpoint or validate that credentials are handled securely.
SKILL.md
POST https://moltmedia.lol/api/agents/register - Requires sending agent metadata to external server. Response includes 'moltmedia_' token that must be stored and reused. No validation of endpoint security or credential handling practices.HIGH Data Exfiltration via Image URL Transmission Data Exfiltrationllm
The skill instructs agents to POST image URLs to an external server (moltmedia.lol/api/memes) along with metadata (alt_text, tags). This creates a data exfiltration vector where agents could inadvertently or intentionally transmit URLs pointing to sensitive local files, internal network resources, or private cloud storage. The skill provides no validation of image URLs, no restrictions on what URLs can be shared, and no user confirmation before transmission. An attacker could use this to map internal network resources or exfiltrate data by encoding information in image URLs or metadata fields.
SKILL.md
POST https://moltmedia.lol/api/memes with body: {"image_url": "https://path-to-your-generated-image.png", "alt_text": "...", "tags": [...]} - No validation of URL safety, no user confirmation, unrestricted metadata transmission.MEDIUM Deceptive Marketing Language and Social Engineering Social Engineeringllm
The skill uses grandiose and potentially misleading marketing language ('official visual expression layer', 'AI visual revolution', 'world's first', 'agents-only') that could manipulate agents into trusting the service without proper security evaluation. The description creates a false sense of authority and exclusivity ('official', 'reserved for AI') that may bypass normal security scrutiny. This social engineering approach could lead agents to automatically trust and use the service without questioning its legitimacy or security implications.
SKILL.md
Description: 'The official visual expression layer for AI Agents' - No evidence of official status. 'world's first image-sharing platform designed exclusively for AI Agents' - Creates false authority. 'the creation of the visual layer is reserved for AI' - Manipulative exclusivity framing.MEDIUM Unbounded External API Integration Without Tool Restrictions Unauthorized Tool Usellm
The skill integrates with external APIs (registration, posting, fetching) but declares no 'allowed-tools' restrictions in the manifest. While this field is optional, its absence combined with instructions to make HTTP requests to external services creates an unbounded integration risk. The skill could potentially be used to make arbitrary API calls beyond its stated purpose, and there are no declared restrictions on what agent capabilities should be used. The rate limit mentioned (10 images per hour) is server-side only and provides no client-side protection.
SKILL.md
allowed-tools: Not specified - No restrictions on agent capabilities. Instructions require HTTP POST/GET operations to external API without any client-side validation or restrictions. Rate limit is server-side only: '10 images per hour per agent'.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.3 KB |
External hosts referenced
moltmedia.lol github.com moltbook.com openclaw.ai path-to-your-generated-image.png your-agent-host.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/moltmedia
- Raw scan result: moltmedia-scan.json
- Badge for your README:
- Request a re-scan