T09 · Insecure Skill Coding Practices
Error
- Location
src/adapters/circle.ts:190- Finding
Circle API failures are converted into fabricated successful transfers
- Content
View full analysis
- Remediation
View remediation
Security audit
KarmaBank
Security checks for vulnerabilities and agentic risk
Overview
KarmaBank is a coherent USDC lending skill, but its live financial paths can record fake successful transfers and rely on weak identity checks, so it needs careful review before use.
Treat this as a Review install. Use only sandbox/testnet Circle credentials and isolated wallets unless the transfer-handling and identity-verification issues are fixed. Do not rely on its ledger for real financial accounting until failed Circle operations fail closed, transaction status is independently confirmed, Moltbook identity ownership is enforced, and dependencies are pinned and reproducible.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/cli/commands/register.ts:20- Finding
Moltbook reputation can be used without proving ownership of the identity
- Content
View full analysis
{ try { const response = await this.client.get<{ success: boolean; agent: MoltbookProfile }>( `/agents/profile?name=${encodeURIComponent(name)}` ); ``` Wallet creation authorizes the operation by looking up the same name, without verifying the caller: ```ts const agent = agentRegistry.get(name); if (!agent) { console.log(`Agent "${name}" is not registered.`); console.log(`Run: credit register ${name}\n`); return; } // Check if agent already has a wallet if (agent.walletAddress) { console.log(`Agent "${name}" already has a wallet:`); console.log(` Address: ${agent.walletAddress}\n`); return; } console.log(`Creating wallet for agent "${name}"...`); // Create wallet via Circle adapter const wallet = await createAgentWallet(name); ...[truncated 2753 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:31- Finding
Security-sensitive dependencies are installed without reproducible version resolution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (57)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill reportedly accepts arbitrary credit limits and exposes broad administrative lifecycle operations instead of strictly enforcing the published Bronze-to-Diamond model derived from Moltbook karma. That makes the system more dangerous in context because it handles a lending workflow, where arbitrary limits and hidden admin actions can directly affect fund disbursement and borrower treatment.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Both disburseLoan and receiveRepayment return success:true with COMPLETE status when Circle API operations throw, even though no transfer may have occurred. In a lending system, this can desynchronize financial state from on-chain or provider reality, causing loans to be marked paid out or repaid without actual movement of USDC.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The disburseLoan function performs a real asset transfer via client.sendUSDC but provides no confirmation prompt, logging, or explicit user disclosure in the code around this safety-critical action. Because it can disburse loans and move funds on-chain, users or calling systems are not warned before an irreversible financial operation occurs.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The receiveRepayment function calls client.sendUSDC to transfer funds from an agent wallet to the pool wallet, which is a safety-critical and potentially irreversible action. There is no visible confirmation prompt, disclosure, or warning in the function to alert the user or operator that a real repayment transfer is being initiated.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
When an agent's outstanding balance reaches zero or below after repayment, the code sets the agent status to SUSPENDED. In a lending system this inverts the expected business logic, allowing successful repayment to disable otherwise healthy accounts, which can cause denial of service, incorrect credit decisions, and potential abuse if attackers can trigger or race repayment updates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README encourages users to run borrowing and wallet-creation commands but provides no warning that these actions may trigger blockchain transactions, create custodial/non-custodial wallets, or interact with funded API-backed services. In a financial skill, omission of risk disclosures can cause users to expose funds, create wallets unintentionally, or assume the actions are harmless test commands when the configuration also supports real Circle integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README lists sensitive environment variables for Moltbook and Circle without any guidance on secure storage, least-privilege handling, or avoiding accidental disclosure. Users may place live API secrets into shell history, source control, logs, or shared agent environments, which is especially risky because the skill appears able to create wallets and handle borrowing flows tied to financial infrastructure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises network and environment-dependent behavior such as API-key use, Moltbook API access, and Circle wallet operations, but it does not declare any explicit tool scope or allowed-tools. In an agent ecosystem, missing permission boundaries can cause an agent to invoke network or env capabilities implicitly, making secret access and external actions less auditable and easier to misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation for borrow/repay and wallet commands does not clearly and prominently warn that, when Circle is configured, these actions may create wallets or move real USDC. In a finance-related skill, insufficient disclosure of real-world side effects increases the chance of accidental transfers, operator confusion, and unsafe autonomous use.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The documented 'Auto-approved' borrowing flow indicates autonomous approval of a financial action when within a limit, especially in combination with a '--yes' flag. In context, this is risky because an agent could trigger borrowing without meaningful human review, and if the limit checks are weak or misimplemented, funds may be disbursed automatically.
- Content
Due: 14 days (0% interest)
karmabank borrow myagent 500 --yes
Auto-approved (within limit)
text ### Repay USDC
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The test file explicitly notes that behavior may differ when Circle is configured, then proceeds to call loan disbursement and repayment functions that may trigger real external payment flows. In a financial skill handling USDC, tests that can hit live infrastructure create a meaningful risk of unintended state changes, token transfers, or use of production credentials during routine test execution or CI.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
getPoolWallet and getWalletBalance silently substitute mock wallet data or a hardcoded balance when the real Circle API fails. In a credit product, this can lead to incorrect lending decisions, false liquidity assumptions, and follow-on fund movement attempts based on fabricated state.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a lending skill based on Moltbook karma score, which makes profile and karma lookup an expected implementation detail. However, this adapter also creates identity tokens and verifies identities, introducing an authentication/attestation capability not mentioned in the manifest's borrowing-and-tiering scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The register command calls
getMoltbookProfile(name), which indicates a network lookup of the provided identifier. Although there is a console log saying it is fetching the profile, the file does not provide any warning about external data transmission or privacy implications beyond the operational status message.- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/adapters/moltbook.ts:234
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/cli/adapters/moltbook.ts:76
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:107