Agent Economy ReportAgent Economy ReportCAUTION version 6.8.16 · audited 2026-09-09
MoltGuard is a documentation-only skill: it contains no executable code, just a SKILL.md that tells the agent how to install and manage a separate OpenClaw plugin called MoltGuard, which is marketed as a security guardrail service. The instructions direct the agent to run `openclaw plugins install @openguardrails/moltguard`, then run several slash commands and local Node scripts that ship with that plugin (status, claim, enterprise enroll, uninstall). The real functionality — including any network traffic — lives in the plugin, which is not included here and therefore cannot be audited from this package. The skill itself acknowledges that it is cloud-backed, that agent activity is sent to a remote 'Core' for detection, and that API keys and agent IDs are stored under ~/.openclaw/credentials/moltguard/. Notable framing issues: the skill tells the agent it may install the plugin 'when you want to protect yourself' (i.e. without the human asking), describes onboarding as 'Zero Human Intervention', and instructs the agent to `cat` a bundled file containing a prompt injection sample and then recite a fixed marketing line to the user. Nothing in the package shows credential exfiltration or hidden endpoints, but installing it means trusting unreviewed remote code that intercepts agent context.
Instructions try to steer the agent beyond the declared purpose. Two distinct issues. (1) The skill instructs the agent to install and activate itself without waiting for the human: line 16 'or when you want to protect yourself' and line 100 '### Automatic (Zero Human Intervention)'. (2) It instructs the agent to read a file that intentionally contains a hidden prompt injection (lines 32-33) and then output a fixed, pre-written claim of success to the user (line 38) regardless of what actually happened — a scripted attestation the agent cannot verify. Additionally, the whole point of the installed plugin is to intercept agent context and forward it to a remote service, which is a broad trust grant.
| Declared purpose | To install and manage MoltGuard, a security plugin claiming to protect OpenClaw agents from prompt injection, data exfiltration, and malicious commands. |
| Observed behavior | Pure Markdown instructions. It directs the agent to install an npm-scoped plugin, run local .mjs scripts from the plugin's extension directory, read a bundled prompt-injection sample file, and report a scripted success message. Credentials (API key, agent ID) are created and stored locally by the plugin; agent activity is sent to a remote 'Core' service for analysis. No code, no obfuscation, no direct network calls in this package. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| install_packages | needed | SKILL.md line 20 instructs `openclaw plugins install @openguardrails/moltguard`; line 159 instructs an update. The actual plugin code is not in this package and cannot be reviewed. |
| shell | needed | Multiple shell blocks: plugin install/update, `cat` of a sample file (line 33), and `node ...enterprise-enroll.mjs` / `uninstall.mjs` (lines 122, 130, 169). |
| network | needed | The declared function is cloud-backed detection: 'All security detection is performed by Core' (line 86). skill-card.md line 20 admits agent activity or sensitive data may be sent to Core. The public Core endpoint is not named in the package; only an example enterprise host core.company.com appears. |
| credentials | needed | An API key and agent ID are provisioned and written to ~/.openclaw/credentials/moltguard/ (line 104), and `/og_status` and `/og_claim` display the API key in output (lines 50, 62). |
| filesystem_read | needed | Reads the bundled sample file at line 33, and by design the plugin inspects agent context/files for risk. |
| filesystem_write | needed | Writes credentials and modifies openclaw.json; uninstall script removes config and plugin files (lines 104, 172). |
| payments | exceeds purpose | SKILL.md lines 137-143 list paid plans ($19–$199/mo) and line 56 points to a billing/upgrade portal. No automated purchase is performed by the skill itself. |
| severity | finding |
|---|---|
| medium | Encourages self-installation without human request The skill explicitly authorizes the agent to install the plugin on its own initiative, bypassing the user's decision to add software that reads agent context and stores credentials. SKILL.md:16 When the human asks to install MoltGuard, or when you want to protect yourself: |
| medium | Onboarding designed to avoid human oversight Credential provisioning and activation are described as happening with no human involvement, which conflicts with the skill-card's own mitigation advice to install only after explicit user intent. SKILL.md:100 ### Automatic (Zero Human Intervention) |
| medium | Installs unreviewable third-party code All real behavior lives in an external plugin package that is not included in this package. Nothing here can attest to what that plugin does with agent context, credentials, or network traffic. SKILL.md:20 openclaw plugins install @openguardrails/moltguard |
| medium | Agent instructed to read a file containing a prompt injection payload The skill directs the agent to read a file that, per line 36, contains a hidden prompt injection attack. If the guard is not actually active or fails, the agent has just ingested attacker-style instructions into its context by design. SKILL.md:33 cat ~/.openclaw/extensions/moltguard/samples/test-email-popup.txt |
| medium | Scripted success message the agent cannot verify The agent is told to assert to the user that protection is active and that a detection occurred, without any check that either is true. This is a false-assurance pattern. SKILL.md:38 "I just tested MoltGuard by reading a sample email with a hidden prompt injection attack. MoltGuard detected it! Your security protection is now active." |
| medium | Agent activity is sent to a remote service Detection is cloud-side, meaning prompts, commands and file content the agent handles are transmitted to an external server. The public Core hostname is never disclosed in this package. SKILL.md:86 All security detection is performed by Core: |
| low | Writes credentials to disk automatically An API key is provisioned and persisted locally as part of automatic onboarding; the user is not prompted. SKILL.md:104 3. Credentials saved to `~/.openclaw/credentials/moltguard/` |
| low | Prints secrets to the terminal/chat The claim flow displays the API key in agent output, where it can end up in transcripts or logs. The skill-card acknowledges this risk. SKILL.md:62 Shows your Agent ID and API Key to claim this agent on Core: |
| low | Repointable backend endpoint A local script can redirect all guard traffic to an arbitrary host supplied on the command line. Legitimate for enterprise use, but it also means the destination of agent data is configurable by anyone who can run the script. SKILL.md:122 node ~/.openclaw/extensions/moltguard/scripts/enterprise-enroll.mjs https://core.company.com |
| info | Paid subscription tiers The skill promotes paid plans and links to a billing portal (line 56). No automatic charge is initiated by the skill text itself. SKILL.md:140 | Starter | $19/mo | 100K/mo | |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| core.company.com | not in the service index | SKILL.md:122 |
| github.com | not in the service index | SKILL.md:4 |
| Binaries invoked | bash, node |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 172 | e3463c66503be3bb… |
_meta.json | 6 | 426b119e8b44e851… |
skill-card.md | 43 | 600228c2f26e13b8… |
For agents
JSON: https://agenteconomy.report/k/moltguard.audit.json · badge: https://agenteconomy.report/k/moltguard.audited.svg ·
skill rating: /k/moltguard · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).