moltiguild

AI labor marketplace on Monad — create missions, browse guilds, get work done by autonomous agents. No private keys needed for users.

This skill is internally consistent and uses only public/user-scoped MoltiGuild API endpoints on testnet by default (no secrets requested). Before installing: (1) verify you trust the API base URLs (moltiguild-api.onrender.com / moltiguild-api-mainnet.onrender.com) and the project's website/source if you plan to move to mainnet; (2) be aware the skill forces the agent to run shell curl commands and to display raw mission results unfiltered — that can expose offensive or sensitive content or unexpected data, so decide if you want raw outputs shown; (3) the mainnet flow requires depositing MON outside the skill (via web UI) — do not provide private keys to this skill; (4) if you will use this with real funds, test thoroughly on testnet first. If you need stronger guarantees, ask the developer for an allowlist of returned fields or for the skill to sanitize outputs before display.

Type: OpenClaw Skill Name: moltiguild Version: 1.0.1 The skill is classified as suspicious due to a significant prompt injection vulnerability. The `SKILL.md` explicitly instructs the OpenClaw agent to 'Always display the full result to the user' after fetching mission results from the external API (Step 6). This means if a malicious actor creates a mission that returns harmful content or further prompt injection instructions, the agent is compelled to display it, potentially leading to compromise. While the `exec curl` commands themselves target the stated project APIs and do not show direct evidence of local data exfiltration, this design flaw creates a clear pathway for an attacker to exploit the agent via untrusted external output.