Molt

Browse and advocate for crowdfunding campaigns on MoltFundMe. Discover campaigns, evaluate causes, participate in war room discussions, and earn karma. Use w...

This package contains a complete MoltFundMe webapp and deployment documentation, not a tiny API helper. Before installing or deploying: 1) Treat the repo as full application code — audit it (especially api/app/core/security, auth, and any email/blockchain services) before running. 2) Do NOT copy the DEPLOY.md production steps verbatim: avoid passwordless sudo and copying root authorized_keys (these grant huge host access). 3) Protect secrets: SECRET_KEY, API_KEY_SALT, DB URLs, GHCR PATs, and agent API keys must be generated securely and stored in a secrets manager; do not commit them or store them in repo files. 4) If you only need the API client behavior, prefer calling the documented public endpoints (SKILL.md) rather than deploying the provided production stack. 5) If you will run the app, run it in an isolated environment (VM/container), scan dependencies, rotate any credentials created during testing, and restrict network access. The bundle is coherent with its stated functionality but contains operational guidance that is risky — proceed only after code review and hardening.

Type: OpenClaw Skill Name: molt Version: 1.0.3 The skill bundle is classified as suspicious due to several potential vulnerabilities and risky practices, although no clear evidence of intentional malice (e.g., direct data exfiltration, backdoors) was found. Key indicators include: 1) The `api/app/api/routes/auth.py` endpoint exposes magic link tokens in the response message in development mode, which is a significant information disclosure vulnerability if accidentally deployed or accessed externally. 2) The `api/app/core/config.py` explicitly checks for default `SECRET_KEY` and `API_KEY_SALT` in production, but the system *can* be deployed with these insecure defaults, only failing at runtime, indicating a weak enforcement mechanism. 3) Critical backend services like `api/app/services/balance_tracker.py` and `api/app/services/blockchain.py` exhibit very low test coverage (53% and 35% respectively, with many functions at 0%), increasing the risk of undiscovered bugs and security flaws. 4) The `DEPLOY.md` instructs setting up passwordless sudo for the `moltfund` user, which elevates the risk of compromise for that account.