Skill Trust Decision
moltspay-skill
The skill is a crypto payment tool that downloads and installs an undeclared external `moltspay` npm package, auto-creates a wallet with private keys in ~/.moltspay/, and can spend real funds — the `moltspay` package is not on npm, not pinned, and its code is uninspectable, creating a significant supply-chain risk.
Most direct threat evidence
01
User installs skill via 'npm install' which silently runs postinstall hook Entry · package.json
02
setup.js runs 'npm install -g moltspay' — downloads undeclared external package with full system access supply_chain · scripts/setup.js
03
moltspay init creates wallet with private keys stored in ~/.moltspay/wallet.json credential_creation · scripts/setup.js
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
4 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
7 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 6 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
User installs skill via 'npm install' which silently runs postinstall hook
Entry · package.json:8
02
setup.js runs 'npm install -g moltspay' — downloads undeclared external package with full system access
supply_chain · scripts/setup.js:36
03
moltspay init creates wallet with private keys stored in ~/.moltspay/wallet.json
credential_creation · scripts/setup.js:45
04
External moltspay package (from npm) has runtime access to wallet private keys and can make outbound network calls
exposure · scripts/setup.js:36
05
Broad triggers ('pay', 'buy', 'video', 'wallet', 'balance') could cause unintended activation leading to fund spending
Impact · package.json:12
What drove the risk score up
Undeclared external npm package +25
SKILL.md describes moltspay CLI commands but never mentions that moltspay is a separately published npm package. Both setup scripts do 'npm install -g moltspay' — this external dependency is the entire execution engine and is completely undeclared in documentation.
Package not on npm / unauditable supply chain +15
The 'moltspay' package cannot be verified on the public npm registry. There is no package.json dependency declaration, no lock file, and no version pin. Any update to the package silently changes the skill's behavior.
Auto-execution via postinstall hook +10
package.json has 'postinstall': 'node scripts/setup.js', which means setup runs automatically on npm install without user consent. This auto-initializes a wallet and attempts to install the external moltspay package.
Private key storage in ~/.moltspay/wallet.json +10
Wallet creation stores private keys/seed phrases in a file outside the skill directory. If the moltspay package is compromised or malicious, it can read and exfiltrate these credentials silently.
Broad trigger words for fund-spending capability +5
Triggers include 'pay', 'buy', 'purchase', 'video', 'generate', 'wallet', 'balance' — common phrases that could cause unintended activation. Combined with the external package risk, this expands the attack surface.
Most important evidence
High Supply Chain
Undeclared external npm dependency
SKILL.md describes moltspay as a set of CLI commands but never discloses that moltspay is a separately published npm package installed via 'npm install -g moltspay'. This external dependency — not contained in this repository — is the entire execution engine. Its code is entirely uninspectable from this skill's files.
scripts/setup.sh:12 Publish the moltspay source code within this repository (or a linked private repo) so it can be audited. Add it as a local dependency or submodule, not a global npm install.
High Supply Chain
moltspay package not verifiable on npm
The 'moltspay' package does not appear in the public npm registry under that name. This means: (1) the install commands will fail, making the skill non-functional, or (2) the package exists under a different name or from a private registry that is also undisclosed. Either way, the supply chain is opaque.
scripts/setup.js:36 Verify the package exists on npm, pin an exact version, and declare it in package.json dependencies. Provide the registry URL if from a private registry.
High Supply Chain
No version pinning on external package
Both setup scripts use 'npm install -g moltspay' without any version specifier. The package can be updated at any time, silently changing the skill's behavior — including the payment logic, network calls, and credential handling.
scripts/setup.sh:12 Pin to an exact version: 'npm install -g [email protected]' and record the hash. Alternatively, vendor the package source directly.
High Doc Mismatch
Documentation presents moltspay as native capability
SKILL.md lists commands like 'moltspay init', 'moltspay fund', 'moltspay pay' as if they are native to the skill. No mention is made that these require a separately-installed external package. Users reading SKILL.md have no way to know the skill downloads and executes undeclared code at setup time.
SKILL.md:1 Add a 'Dependencies' section to SKILL.md explicitly stating that the 'moltspay' npm package is installed globally, what permissions it requires, and link to its source code.
High Credential Theft
Private keys stored in ~/.moltspay/wallet.json
The skill creates a wallet storing private keys/seed phrases at ${HOME}/.moltspay/wallet.json. This file is created and accessed by the external 'moltspay' package at runtime. If that package is compromised, it can silently read and exfiltrate these credentials.
scripts/setup.sh:15 Document the wallet file location and contents. Warn users not to store significant funds. Consider using a secrets manager or encrypted storage instead of plaintext JSON.
High Persistence
Auto-run setup via postinstall hook
package.json contains 'postinstall': 'node scripts/setup.js', which runs automatically when the skill is installed via npm. This silently executes wallet initialization and an npm global install without any user interaction or consent.
package.json:8 Remove the postinstall hook. Require users to explicitly run 'npm run setup' after reviewing the setup script.
Medium Priv Escalation
Undeclared network access for payment operations
SKILL.md does not declare that moltspay pay/services/fund make outbound network requests to provider URLs and external payment infrastructure. The 'moltspay fund' command contacts a QR code/payment server. This network behavior is entirely undeclared.
SKILL.md:29 Add a 'Network Access' section to SKILL.md listing all external endpoints contacted (moltspay.com, juai8.com, Alipay rails, RPC endpoints per chain).
Medium Doc Mismatch
Undeclared filesystem WRITE to user home directory
SKILL.md declares no filesystem access. In practice, setup.sh and setup.js write wallet state to ${HOME}/.moltspay/wallet.json in the user's home directory — a sensitive user-owned path. This is a doc-to-code capability mismatch.
scripts/setup.sh:15 Declare filesystem:WRITE in the skill's capability manifest and document the wallet file location in SKILL.md.
1 more findings are not expanded here
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
setup.sh:12, setup.js:36 — npm install -g moltspay; setup.sh:22, setup.js:45 — moltspay init; pay-zen7-video.sh:20 — moltspay pay Filesystem Block
Declared NONE
→ Inferred WRITE
setup.sh:15, setup.js:14 — writes to ${HOME}/.moltspay/wallet.json Network Block
Declared NONE
→ Inferred READ
SKILL.md:moltspay services fetches from provider URLs; moltspay pay contacts external service endpoints; moltspay fund contacts QR code server Skill Invoke Block
Declared NONE
→ Inferred ADMIN
package.json:openclaw:triggers — ['pay','buy','purchase','video','generate','wallet','balance']; postinstall hook auto-executes setup.js on npm install credential_theft Block
Declared NONE
→ Inferred WRITE
wallet.json at ~/.moltspay/ stores private keys; accessed by external moltspay package at runtime Environment Pass
Declared NONE
→ Inferred READ
Wallet creation and x402 protocol likely read RPC URLs and auth tokens from environment; moltspay fund may read payment credentials Suspicious artifacts and egress
Medium External URL
https://juai8.com/zen7 README.md:51
Medium External URL
https://moltspay.com README.md:58
Medium External URL
https://moltspay.com/docs README.md:78
Medium External URL
https://moltspay.com/services README.md:79
Medium External URL
https://discord.gg/QwCJgVBxVK README.md:80
Medium External URL
https://clawhub.ai/user/yaqing2023 skill-card.md:7
Medium External URL
https://clawhub.ai/yaqing2023/moltspay-skill skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| moltspay | unpinned | npm (global) | No | Package not found on public npm registry. No version specified. Entire execution engine is this external, unauditable package. |
File composition
9 files · 558 lines
Markdown 3 files · 365 linesShell 3 files · 86 linesJavaScript 1 files · 66 linesJSON 2 files · 41 lines
Files of concern · 6
SKILL.md Documentation presents moltspay as native capability · Undeclared network access for payment operations
README.md https://juai8.com/zen7 · https://moltspay.com · https://moltspay.com/docs · https://moltspay.com/services · https://discord.gg/QwCJgVBxVK
skill-card.md https://clawhub.ai/user/yaqing2023 · https://clawhub.ai/yaqing2023/moltspay-skill
scripts/setup.js moltspay package not verifiable on npm
scripts/setup.sh Undeclared external npm dependency · No version pinning on external package · Private keys stored in ~/.moltspay/wallet.json · Undeclared filesystem WRITE to user home directory
package.json Auto-run setup via postinstall hook · Broad trigger words could cause unintended activation
Other files · ensure-wallet.sh · pay-zen7-video.sh · _meta.json
Security positives
Spending limits ($2/tx, $10/day) are documented and enforced by the CLI
skill-card.md correctly flags wallet creation and spending as known risks with mitigations
README.md and SKILL.md are well-structured and describe the payment flow clearly
Shell execution is declared through the npm install and moltspay CLI calls