Security audit

KarmaBank

Security checks across malware telemetry and agentic risk

Overview

KarmaBank mostly matches its USDC lending purpose, but it needs Review because it exposes credentials and bundles high-impact wallet operations with inconsistent financial disclosures.

Review carefully before installing. Use only sandbox/test Circle and Moltbook credentials, rotate the exposed Moltbook key, avoid running the bundled Circle helper scripts with production keys, and reconcile the loan terms and live-transfer behavior before trusting it with funds or agent credit records.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes use of environment variables and external network services (Moltbook and Circle), but no declared permissions are presented to scope or warn about those capabilities. This can cause agents or operators to install and run a skill that accesses secrets and remote services without an explicit permission boundary, increasing the chance of unintended credential exposure or network actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a borrowing skill, but the behavior described by analysis includes secret generation/printing, cryptographic key handling, wallet-set creation, local ledger persistence, mock transfers, and debugging utilities beyond the narrow user-facing claim. That mismatch is dangerous because operators may trust the skill as a simple credit tool while it performs sensitive wallet-management and secret-handling actions that materially expand the attack surface.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The documentation materially conflicts with the skill metadata: one states zero interest while the submission states a 5% flat interest rate plus late fees. For a lending and fund-moving skill, this is a dangerous transparency failure because users and downstream agents may make financial decisions based on the wrong terms, leading to unauthorized charges, disputes, or deceptive behavior.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The claim 'No KYC, no collateral. Just reputation' is misleading because eligibility also depends on X verification and follower count, which are external identity/social signals rather than pure in-platform reputation. In a credit product, this can misrepresent underwriting criteria, cause unfair user expectations, and hide factors that affect approval or credit limits.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The TODO file directly embeds what appears to be a live Moltbook secret API key. Exposed credentials can be harvested from source control, logs, or package artifacts and then used to impersonate the project, access protected API functions, or pivot into other connected systems.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This script handles highly sensitive Circle credentials and an entity secret, then logs both the API key prefix and the generated secret to stdout. Even if intended for local setup, console output is commonly captured by shells, CI logs, terminals, or observability tooling, which can leak credentials and enable unauthorized wallet or account operations.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script uses live Circle API credentials to enumerate wallet sets, which reveals account inventory unrelated to the stated loan-origination purpose. Even as a test utility, this expands the skill's effective capability and could expose sensitive operational metadata or be repurposed for reconnaissance if the script is shipped or run in shared environments.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The script explicitly prints `CIRCLE_API_KEY` to console as part of the `.env` instructions. Console output is commonly captured in shell history, CI logs, terminal recordings, and support screenshots, so this can leak a live credential beyond its intended scope.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The comment says the code is encrypting a secret with the public key, but the implementation sends the raw PEM public key as `entitySecretCiphertext`. This mismatch can mislead operators into believing a sensitive registration step is being performed securely when it is not, increasing the chance of misconfiguration or insecure secret handling.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script prints both a partial Circle API key and the full plaintext entity secret to stdout. Console output is commonly captured in shell history, CI logs, terminal scrollback, screen recordings, and observability tooling, so this can directly expose credentials that enable wallet or transfer operations.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: This script performs Circle entity secret registration, which is a sensitive wallet-administration capability unrelated to the stated skill purpose of determining USDC loan amounts from a karma score. Even if intended for setup, embedding and exposing this capability in the skill broadens the attack surface and could let a compromised or misused agent initialize or manipulate wallet control material.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script loads a Circle API key from the environment and uses it to create a wallet set, which is a privileged financial-management action. In the context of a lending skill, this capability is broader than the stated purpose and, if executed in the wrong environment, could create unauthorized wallet infrastructure or encourage unsafe use of production credentials in a test script.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script reads a sensitive Circle API key from the environment and logs a visible prefix of it to stdout. Even partial credential disclosure is unsafe because logs are often aggregated, shared, or retained, and the key exposure is not necessary for testing SDK functionality. In a financial/lending-related skill, exposing payment or wallet infrastructure credentials increases the chance of account misuse or reconnaissance against production systems.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script reads a sensitive Circle API key from the environment and prints a portion of it along with whether it is a test or production credential. Even partial credential disclosure can aid fingerprinting, leak operational context into logs, and increase the blast radius if console output is captured by CI systems, terminals, or shared logging backends. This is unrelated to the stated lending purpose and expands exposure of secrets during debugging.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The repayment handler ignores the supplied repayment amount entirely and unconditionally marks the loan as fully repaid. This allows partial, zero-value, or otherwise invalid repayments to close a debt record, which can corrupt lending state and let borrowers appear current without satisfying their obligation.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: When an agent's outstanding balance reaches zero or below, the code sets the agent status to SUSPENDED, which is the opposite of expected post-repayment behavior. In a credit system, this can wrongfully disable compliant borrowers after successful repayment, creating denial of service against legitimate users and undermining core business logic.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The data model permits non-zero interest via the optional interestRate field and create() defaults it from caller input, which conflicts with the skill's stated zero-interest lending behavior. In a financial skill, this creates policy-integrity risk: downstream code or operators could originate loans with unauthorized interest, causing user harm, disputes, or deceptive lending behavior.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: A loan ledger that supports permanent record deletion can erase accountability, audit history, and evidence of debt status. In a credit system, this can be abused to hide outstanding/defaulted loans or tamper with financial records, undermining trust and enabling fraud if exposed through any agent or API path.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The 'Full Integration' workflow instructs users to configure real Moltbook and Circle credentials and then perform wallet creation, borrowing, balance checks, and repayment without an explicit warning that these commands may hit live services and affect real wallets or funds. In a financial skill, that omission materially increases the chance of accidental live transactions, credential misuse, or unintended on-chain activity by users who assume the demo remains sandboxed.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation shows borrow/repay and wallet commands as routine usage but does not clearly warn that these operations can change loan records, wallet state, or move testnet USDC. Users may invoke commands assuming they are read-only or harmless, leading to unintended transfers, balance changes, or irreversible state mutations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The commands include wallet creation, borrowing, repayment, and USDC transfer operations, but the skill text does not warn users that these actions can create wallets and move real or test funds. In an agentic or CLI context, insufficient transaction warnings increase the risk of accidental fund movement, mistaken approvals, and unsafe automation around financial operations.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The example curl command normalizes use of a bearer token without any warning about secret handling, increasing the chance that operators paste real credentials into shells, screenshots, logs, or shared transcripts. In a skill centered on financial reputation and API-backed decisions, poor credential hygiene materially raises abuse risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script prints the Circle API key prefix to the console, unnecessarily exposing credential material in terminal history, logs, CI output, or screen recordings. Even partial secret disclosure aids attackers in secret identification, correlation, and operational misuse, especially in financial API contexts.

Missing User Warnings

High

Confidence: 100% confidence
Finding: The generated entity secret is printed in full and then echoed again as an environment variable assignment, creating a direct secret disclosure path through console logs and shell history. Anyone with access to logs or the operator terminal could capture the secret and use it in downstream Circle-related operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Printing even a partial API key is sensitive because logs may be retained or exposed, and partial secrets aid correlation, identification of active credentials, and accidental disclosure during support or screen sharing. While a prefix alone may not grant access, it weakens secret hygiene and can facilitate targeted attacks or credential mishandling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/circle-entity-secret.js:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/circle-entity-secret.ts:18

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/adapters/moltbook.ts:234

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/cli/adapters/moltbook.ts:76

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:107