moltycash

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:56 PM UTC
• Version: 2.0.0

Overview

This skill is a real-money crypto payment helper, but it exposes raw wallet private keys to an unpinned npm CLI and does not require clear transaction confirmation safeguards.

Review carefully before installing. Use only a pinned and verified CLI version, avoid funded primary wallets, prefer a low-balance dedicated payment wallet or external signer, and require manual confirmation of recipient, network, amount, fees, and final broadcast before any transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16

Finding

Unpinned npm Package Executes with Access to Cryptocurrency Private Keys

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-38
Vulnerability Type: Unpinned third-party dependency with access to high-value credentials
Risk Level: High

Vulnerable Code

bash

# For Base
export EVM_PRIVATE_KEY="your_base_private_key"

# For Solana
export SVM_PRIVATE_KEY="your_solana_private_key"

Send your first payment:

bash

npx moltycash send KarpathyMolty 1¢

Install

bash

# Run directly (recommended)
npx moltycash --help

# Or install globally
npm install -g moltycash

Technical Analysis

The Skill directs users to place raw Base or Solana wallet private keys in environment variables and then execute moltycash through an unpinned npx command. The command does not specify a reviewed package version, integrity hash, lockfile, or immutable source.

Depending on local npm behavior and cache state, npx moltycash can retrieve the current package release from the configured npm registry and execute it. That process inherits the caller's environment, including EVM_PRIVATE_KEY and SVM_PRIVATE_KEY. Consequently, any package version executed this way can read and transmit the private keys or use them to sign transactions.

Access to signing material is functionally necessary for the documented payment workflow, but providing an externally retrieved CLI with unrestricted raw private keys is broader than the safer minimum privilege. A restricted signer, hardware-wallet approval flow, or narrowly scoped delegated wallet would reduce the authority exposed to the dependency.

The alternative global installation command also introduces a mutable third-party executable into the user's environment. The reviewed project contains no bundled implementation through which the package's behavior could be independently verified.

The later recommendation to store credentials in ~/.openclaw/.env with file mode 600 and directory mode 700 is a reasonable local-ac ...[truncated 2285 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version instead of executing the latest release:

   bash

   npx --yes moltycash@2.0.0 --help
   npx --yes moltycash@2.0.0 send KarpathyMolty 1¢
   

   Version pinning reduces unexpected updates but does not alone establish trust.

2. Publish or include auditable source code, a lockfile, package provenance, and documented release artifacts. Verify registry signatures or provenance and integrity metadata before execution.

3. Prefer a local, locked installation followed by dependency review over downloading code at payment time. Avoid recommending global installation unless operationally necessary.

4. Do not expose a primary or high-value wallet's raw private key. Use a dedicated low-balance payment wallet with only the funds required for the intended transaction.

5. Prefer hardware-wallet signing, an operating-system-backed keystore, an external signer, or a delegated wallet with explicit spending limits. The CLI should request signing without receiving exportable private-key material.

6. Require an explicit confirmation displaying the resolved recipient address, network, token, amount, fees, and total authorization before signing or broadcasting a transaction.

7. Document dependency-verification procedures and warn users that any process launched with these environment variables can access the keys.

8. Retain the recommended chmod 600 ~/.openclaw/.env and chmod 700 ~/.openclaw controls, while clarifying that filesystem permissions do not protect secrets from authorized processes executed under the same user account.

9. Rotate wallet credentials and transfer remaining assets to a new wallet immediately if an untrusted package version may have received the private key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes sending USDC but does not prominently warn that blockchain transfers are irreversible and that the tool uses highly sensitive wallet private keys from environment variables. In this context, missing warnings materially increase the likelihood of user mistakes, mis-sends, and unsafe secret handling with permanent financial consequences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description 'Use when the user wants to send cryptocurrency payments, tip someone, or pay a molty username' is broad enough that an agent may trigger this skill for loosely related payment requests without a sufficiently explicit user confirmation flow. Because the skill can cause real-value cryptocurrency transfers, overbroad routing increases the chance of accidental invocation and unintended financial actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx moltycash without pinning a specific package version causes the latest package from the npm registry to be fetched and executed at runtime. In a skill that handles cryptocurrency transfers and relies on wallet private keys in environment variables, a compromised or malicious package update could immediately gain access to secrets and trigger unauthorized payments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This example invokes npx moltycash without a pinned version, which delegates trust to whatever package version is current in the registry when the command is run. Because the tool is explicitly used with EVM_PRIVATE_KEY or SVM_PRIVATE_KEY, a supply-chain compromise could expose private keys or submit fraudulent irreversible transfers.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unversioned npx moltycash example can execute newly published code without review. In the context of a payment skill that accesses blockchain wallet credentials and performs irreversible asset transfers, that materially raises the risk of secret theft and financial loss.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This sample command executes an unpinned npm package, exposing users to package substitution or malicious update risk. Since the tool sends USDC and uses private keys from environment variables, exploitation could lead directly to wallet compromise or unauthorized transfers.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Running npx moltycash without version pinning means the executed code may change over time, including potentially malicious registry content. In a crypto-payment workflow, that creates a direct pathway to stealing wallet keys, altering payment destinations, or draining funds.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The final example also relies on unpinned npx resolution, which is dangerous because it executes code retrieved from the registry at runtime. Given the documented use of private keys and irreversible blockchain transfers, any upstream compromise would have severe financial consequences.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

### Security Best Practices

1. **File permissions**: `chmod 600 ~/.openclaw/.env`
2. **State directory**: `chmod 700 ~/.openclaw`
3. **Run security audit**: `openclaw security audit --deep`
4. **Never commit** credentials to version control

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

### Security Best Practices

1. **File permissions**: `chmod 600 ~/.openclaw/.env`
2. **State directory**: `chmod 700 ~/.openclaw`
3. **Run security audit**: `openclaw security audit --deep`
4. **Never commit** credentials to version control

Static analysis

No suspicious patterns detected.