Security audit

KarmaBank

Security checks for vulnerabilities and agentic risk

Overview

KarmaBank is a coherent USDC lending skill, but its financial and credential handling has serious review-worthy safety gaps before installation.

Review this skill before installing, especially in any environment with real Circle credentials or funds. Use only isolated testnet/sandbox credentials, avoid running npm install until the local file dependency is reviewed or scripts are disabled, do not paste secrets into shell commands, and do not rely on its loan ledger for real accounting until transfers fail closed and Moltbook identity ownership is verified.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: src/adapters/circle.ts:162
Finding: Circle API Failures Are Converted into Fabricated Successful Transfers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/circle-entity-secret.ts:29
Finding: Circle API Keys and Wallet Entity Secrets Are Exposed in Terminal Output
Content: View full analysis
`); ``` ### Technical Analysis The setup scripts write substantial portions of the Circle API key and complete plaintext entity secrets to standard output. One script prints the entire API key. These values are high-sensitivity authentication and wallet-control material. Standard output is not a secure secret-delivery channel. It is commonly retained by CI systems, shell session recorders, terminal scrollback, Agent transcripts, centralized logging platforms, and automation wrappers. Printing the same entity secret multiple times increases the exposure surface. Masking only the end of an ...[truncated 1348 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate-circle-secret.ts:38
Finding: Private Key Is Written Insecurely to a Predictable Shared Temporary File
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/cli/commands/register.ts:20
Finding: Moltbook Reputation Can Be Registered and Used Without Proving Agent Ownership
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: package.json:39
Finding: Unaudited Local Circle Dependency Executes an Installation Lifecycle Script
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (139)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The instruction echo "MOLTBOOK_API_KEY=your_key" >> .env encourages entering a secret directly into the shell command line, which may be captured in shell history, terminal logs, clipboard tools, or CI output. Although the secret ends up in .env, the immediate entry method is unsafe and can leak credentials beyond the intended file.
Content: Scanner excerpt · DEMO.md (reported line 529)May include surrounding context.
Solution:

bash
# Add API key to .env echo "MOLTBOOK_API_KEY=your_key" >> .env # Re-run command

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This line is part of the same unsafe shell-based API key insertion workflow and exposes the same risk of credential leakage through shell history or command auditing. In an agent-oriented environment, commands may also be logged by orchestration systems, magnifying exposure.
Content: Scanner excerpt · DEMO.md (reported line 530)May include surrounding context.
Solution:

bash
# Add API key to .env echo "MOLTBOOK_API_KEY=your_key" >> .env # Re-run command karmabank check youragentname

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a karma-based USDC lending product, but the findings indicate materially different behaviors including credential handling, Circle wallet bootstrap/configuration, secret generation, and other undeclared infrastructure actions. This mismatch is dangerous because users may provide high-value API credentials under a false mental model, enabling sensitive wallet or payment operations they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/circle-entity-secret.js:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/circle-entity-secret.ts:18

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/adapters/moltbook.ts:234

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/cli/adapters/moltbook.ts:76

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:107