中文 EN
开始可信审查
安全决策报告

moltspay-skill

The skill is a crypto payment tool that downloads and installs an undeclared external `moltspay` npm package, auto-creates a wallet with private keys in ~/.moltspay/, and can spend real funds — the `moltspay` package is not on npm, not pinned, and its code is uninspectable, creating a significant supply-chain risk.

安装决策优先 来源: ClawHub 扫描时间: 19 天前
文件 9
IOC 7
越权项 4
发现 9
最直接的威胁证据
01
User installs skill via 'npm install' which silently runs postinstall hook 初始入口 · package.json
02
setup.js runs 'npm install -g moltspay' — downloads undeclared external package with full system access supply_chain · scripts/setup.js
03
moltspay init creates wallet with private keys stored in ~/.moltspay/wallet.json credential_creation · scripts/setup.js

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 4 项声明之外的能力或越权行为。

复核
隐藏执行与外联

提取到 7 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 5 步攻击链，另有 6 项高危或严重发现。

通过
依赖与供应链卫生

依赖结构存在，但暂未看到明显高危告警。

攻击链

01
User installs skill via 'npm install' which silently runs postinstall hook

初始入口 · package.json:8

02
setup.js runs 'npm install -g moltspay' — downloads undeclared external package with full system access

supply_chain · scripts/setup.js:36

03
moltspay init creates wallet with private keys stored in ~/.moltspay/wallet.json

credential_creation · scripts/setup.js:45

04
External moltspay package (from npm) has runtime access to wallet private keys and can make outbound network calls

exposure · scripts/setup.js:36

05
Broad triggers ('pay', 'buy', 'video', 'wallet', 'balance') could cause unintended activation leading to fund spending

最终危害 · package.json:12

风险分是怎么被拉高的

Undeclared external npm package +25

SKILL.md describes moltspay CLI commands but never mentions that moltspay is a separately published npm package. Both setup scripts do 'npm install -g moltspay' — this external dependency is the entire execution engine and is completely undeclared in documentation.

Package not on npm / unauditable supply chain +15

The 'moltspay' package cannot be verified on the public npm registry. There is no package.json dependency declaration, no lock file, and no version pin. Any update to the package silently changes the skill's behavior.

Auto-execution via postinstall hook +10

package.json has 'postinstall': 'node scripts/setup.js', which means setup runs automatically on npm install without user consent. This auto-initializes a wallet and attempts to install the external moltspay package.

Private key storage in ~/.moltspay/wallet.json +10

Wallet creation stores private keys/seed phrases in a file outside the skill directory. If the moltspay package is compromised or malicious, it can read and exfiltrate these credentials silently.

Broad trigger words for fund-spending capability +5

Triggers include 'pay', 'buy', 'purchase', 'video', 'generate', 'wallet', 'balance' — common phrases that could cause unintended activation. Combined with the external package risk, this expands the attack surface.

最关键的证据

高危 供应链

Undeclared external npm dependency

SKILL.md describes moltspay as a set of CLI commands but never discloses that moltspay is a separately published npm package installed via 'npm install -g moltspay'. This external dependency — not contained in this repository — is the entire execution engine. Its code is entirely uninspectable from this skill's files.

scripts/setup.sh:12
Publish the moltspay source code within this repository (or a linked private repo) so it can be audited. Add it as a local dependency or submodule, not a global npm install.
高危 供应链

moltspay package not verifiable on npm

The 'moltspay' package does not appear in the public npm registry under that name. This means: (1) the install commands will fail, making the skill non-functional, or (2) the package exists under a different name or from a private registry that is also undisclosed. Either way, the supply chain is opaque.

scripts/setup.js:36
Verify the package exists on npm, pin an exact version, and declare it in package.json dependencies. Provide the registry URL if from a private registry.
高危 供应链

No version pinning on external package

Both setup scripts use 'npm install -g moltspay' without any version specifier. The package can be updated at any time, silently changing the skill's behavior — including the payment logic, network calls, and credential handling.

scripts/setup.sh:12
Pin to an exact version: 'npm install -g [email protected]' and record the hash. Alternatively, vendor the package source directly.
高危 文档欺骗

Documentation presents moltspay as native capability

SKILL.md lists commands like 'moltspay init', 'moltspay fund', 'moltspay pay' as if they are native to the skill. No mention is made that these require a separately-installed external package. Users reading SKILL.md have no way to know the skill downloads and executes undeclared code at setup time.

SKILL.md:1
Add a 'Dependencies' section to SKILL.md explicitly stating that the 'moltspay' npm package is installed globally, what permissions it requires, and link to its source code.
高危 凭证窃取

Private keys stored in ~/.moltspay/wallet.json

The skill creates a wallet storing private keys/seed phrases at ${HOME}/.moltspay/wallet.json. This file is created and accessed by the external 'moltspay' package at runtime. If that package is compromised, it can silently read and exfiltrate these credentials.

scripts/setup.sh:15
Document the wallet file location and contents. Warn users not to store significant funds. Consider using a secrets manager or encrypted storage instead of plaintext JSON.
高危 持久化

Auto-run setup via postinstall hook

package.json contains 'postinstall': 'node scripts/setup.js', which runs automatically when the skill is installed via npm. This silently executes wallet initialization and an npm global install without any user interaction or consent.

package.json:8
Remove the postinstall hook. Require users to explicitly run 'npm run setup' after reviewing the setup script.
中危 权限提升

Undeclared network access for payment operations

SKILL.md does not declare that moltspay pay/services/fund make outbound network requests to provider URLs and external payment infrastructure. The 'moltspay fund' command contacts a QR code/payment server. This network behavior is entirely undeclared.

SKILL.md:29
Add a 'Network Access' section to SKILL.md listing all external endpoints contacted (moltspay.com, juai8.com, Alipay rails, RPC endpoints per chain).
中危 文档欺骗

Undeclared filesystem WRITE to user home directory

SKILL.md declares no filesystem access. In practice, setup.sh and setup.js write wallet state to ${HOME}/.moltspay/wallet.json in the user's home directory — a sensitive user-owned path. This is a doc-to-code capability mismatch.

scripts/setup.sh:15
Declare filesystem:WRITE in the skill's capability manifest and document the wallet file location in SKILL.md.

还有 1 项发现未展开显示

声明能力 vs 实际能力

命令执行 通过
声明 WRITE
→
推断 WRITE
setup.sh:12, setup.js:36 — npm install -g moltspay; setup.sh:22, setup.js:45 — moltspay init; pay-zen7-video.sh:20 — moltspay pay
文件系统 阻止
声明 NONE
→
推断 WRITE
setup.sh:15, setup.js:14 — writes to ${HOME}/.moltspay/wallet.json
网络访问 阻止
声明 NONE
→
推断 READ
SKILL.md:moltspay services fetches from provider URLs; moltspay pay contacts external service endpoints; moltspay fund contacts QR code server
技能调用 阻止
声明 NONE
→
推断 ADMIN
package.json:openclaw:triggers — ['pay','buy','purchase','video','generate','wallet','balance']; postinstall hook auto-executes setup.js on npm install
credential_theft 阻止
声明 NONE
→
推断 WRITE
wallet.json at ~/.moltspay/ stores private keys; accessed by external moltspay package at runtime
环境变量 通过
声明 NONE
→
推断 READ
Wallet creation and x402 protocol likely read RPC URLs and auth tokens from environment; moltspay fund may read payment credentials

可疑产物与外联

中危 外部 URL
https://juai8.com/zen7

README.md:51

中危 外部 URL
https://moltspay.com

README.md:58

中危 外部 URL
https://moltspay.com/docs

README.md:78

中危 外部 URL
https://moltspay.com/services

README.md:79

中危 外部 URL
https://discord.gg/QwCJgVBxVK

README.md:80

中危 外部 URL
https://clawhub.ai/user/yaqing2023

skill-card.md:7

中危 外部 URL
https://clawhub.ai/yaqing2023/moltspay-skill

skill-card.md:29

依赖与供应链

包名版本来源漏洞备注
moltspay unpinned npm (global) 否 Package not found on public npm registry. No version specified. Entire execution engine is this external, unauditable package.

文件构成

9 个文件 · 558 行
Markdown 3 个文件 · 365 行Shell 3 个文件 · 86 行JavaScript 1 个文件 · 66 行JSON 2 个文件 · 41 行
需关注文件 · 6
SKILL.md Markdown · 237 行
Documentation presents moltspay as native capability · Undeclared network access for payment operations
README.md Markdown · 84 行
https://juai8.com/zen7 · https://moltspay.com · https://moltspay.com/docs · https://moltspay.com/services · https://discord.gg/QwCJgVBxVK
skill-card.md Markdown · 44 行
https://clawhub.ai/user/yaqing2023 · https://clawhub.ai/yaqing2023/moltspay-skill
scripts/setup.js JavaScript · 66 行
moltspay package not verifiable on npm
scripts/setup.sh Shell · 42 行
Undeclared external npm dependency · No version pinning on external package · Private keys stored in ~/.moltspay/wallet.json · Undeclared filesystem WRITE to user home directory
package.json JSON · 36 行
Auto-run setup via postinstall hook · Broad trigger words could cause unintended activation
其他文件 · ensure-wallet.sh · pay-zen7-video.sh · _meta.json

安全亮点

Spending limits ($2/tx, $10/day) are documented and enforced by the CLI
skill-card.md correctly flags wallet creation and spending as known risks with mitigations
README.md and SKILL.md are well-structured and describe the payment flow clearly
Shell execution is declared through the npm install and moltspay CLI calls