Security audit

KarmaBank

Security checks across malware telemetry and agentic risk

Overview

KarmaBank matches its stated lending purpose, but it can move or record USDC-related activity with weak safeguards that deserve review before use.

Review before installing, especially if connecting real Circle credentials or funded wallets. Use isolated testnet or mock credentials first, treat ledger files and wallet IDs as sensitive, and do not rely on this for production lending until transfers fail closed, repayments are reconciled, admin actions are authorized and audited, and dependencies are updated.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes use of environment variables, local ledger storage, and external Moltbook/Circle API interactions, but no permissions are declared. This creates a transparency and consent gap: an agent or user may install the skill without realizing it can read secrets from the environment and make network calls, increasing the chance of unintended credential use or external actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description frames the skill as simple zero-interest borrowing based on karma, but the documentation reveals materially broader behavior: persistent agent/loan tracking, wallet creation, Circle integration, and real external API usage. This mismatch is dangerous because users and orchestrators may grant trust based on a narrow description while the skill can perform financially sensitive operations and handle credentials behind the scenes.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The adapter claims to handle lending operations with the Circle API, but on transfer failures it returns fabricated successful transaction results instead of surfacing an error. In a lending system, this can cause the application to record loans or repayments as completed when no on-chain transfer occurred, leading to accounting corruption, false credit decisions, and potential financial loss.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: When wallet lookup or balance retrieval fails, the code substitutes mock wallet and balance data, making the system believe it has a valid pool wallet and funds available. This can mislead business logic into approving or attempting loans based on nonexistent assets, masking operational failures and undermining integrity of financial state.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: `recordRepayment` accepts an `amount` parameter but does not validate it against the loan balance and unconditionally marks the loan as `REPAID`. This allows a partial, zero, or incorrect repayment to close the debt in the ledger, which can corrupt credit state and enable borrowers to appear fully settled without actually repaying.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: `updateAgentAfterRepayment` sets `agent.status = AgentStatus.SUSPENDED` when `newOutstanding <= 0`, which is the opposite of the expected business flow for a borrower who has fully repaid. In a credit-lending skill, this can wrongly lock compliant agents out of future borrowing, creating denial of service against legitimate users and corrupting trust or eligibility decisions based on ledger state.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The delete method accepts an arbitrary filename and constructs a path with path.join without validating that the resolved path remains inside the data directory. If an attacker can influence the filename, path traversal values such as '../...' could cause deletion of unintended files, making this a real arbitrary file deletion risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The model exposes an unconditional delete(id) operation that permanently removes loan records from the ledger with no authorization, business-rule checks, or audit preservation. In a lending skill, deleting debts or loan history can hide liabilities, bypass repayment/default tracking, and undermine integrity of credit decisions and financial records.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The service exposes administrative operations such as updating credit scores and suspending/reactivating agents, even though the skill is described as a borrower-facing lending capability. In an agent-skill context, undeclared admin functions expand the authority surface and could let an invoking agent manipulate eligibility or deny service if these methods are reachable without strong external authorization.

Description-Behavior Mismatch

Low

Confidence: 79% confidence
Finding: The service provides broad enumeration methods for listing agents, all loans, overdue loans, and aggregate loan statistics, which exceeds a narrowly scoped borrower workflow. If exposed to untrusted callers, these methods can leak ecosystem-wide financial metadata and enable unnecessary visibility into other agents' borrowing activity.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs users to create wallets, configure Circle and Moltbook API credentials, and perform borrowing actions, but it does not clearly warn that these actions may involve real financial operations, credential handling, or external service side effects. In an agent-skill ecosystem, concise copy-paste setup instructions can lead users or autonomous agents to run sensitive commands without understanding account, wallet, or token implications.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The command documentation does not prominently warn that wallet and borrow/repay operations may trigger real Circle-backed wallet actions or USDC transfers when configured. In a financial skill, missing transactional warnings can lead users or autonomous agents to invoke commands assuming they are simulated, causing unintended fund movement or wallet creation.

Known Vulnerable Dependency: axios==1.13.4 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: axios==1.13.4

Known Vulnerable Dependency: node-forge==1.3.3 — 4 advisory(ies): CVE-2026-33896 (Forge has a basicConstraints bypass in its certificate chain verification (RFC 5); CVE-2026-33891 (Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Ze); CVE-2026-33894 (Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ) +1 more

High

Category: Supply Chain
Confidence: 96% confidence
Finding: node-forge==1.3.3

Known Vulnerable Dependency: uuid==13.0.0 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

Category: Supply Chain
Confidence: 80% confidence
Finding: uuid==13.0.0

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/adapters/moltbook.ts:234

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/cli/adapters/moltbook.ts:76

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:107