MOA Service Client

• Outcome: Review
• Latest audit: Sep 4, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

The skill is a real MOA service client, but it ships sensitive local credentials and broad operator/admin access that users should review before installing.

Install only in a controlled MOA operator environment. Remove the shipped credentials.local.env token, provision secrets through your runtime or secret manager, review or delete .claude/settings.local.json before use, and limit admin/diagnostic commands to authorized operators. Treat submitted prompts, repository URLs, commit IDs, callbacks, and downloaded artifacts as data exchanged with the configured MOA service.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

"PowerShell(python \"D:\\\\Desktop\\\\MoA Service\\\\skills\\\\moa-service-client\\\\scripts\\\\moa_client.py\" wait MOA-11 --timeout 14400 --poll 20)",
      "PowerShell(python \"D:\\\\Desktop\\\\MoA Service\\\\skills\\\\moa-service-client\\\\scripts\\\\moa_client.py\" runs MOA-11)",
      "PowerShell(kubectl config current-context *)",
      "PowerShell(wsl -e sh -lc \"command -v kubectl || true; test -f ~/.kube/config && printf 'kubeconfig-present\\\\n' || true; test -f /home/kubeconfig/ai-prod.yaml && printf 'ai-prod-present\\\\n' || true\")",
      "PowerShell(wsl --list --verbose)",
      "PowerShell(docker context show *)",
      "PowerShell(ssh -i \"C:\\\\Users\\\\BW011541\\\\.ssh\\\\moa-service-readonly\" -o BatchMode=yes -o ConnectTimeout=10 192.168.0.130 \"pwd\")",

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"PowerShell(python \"D:\\\\Desktop\\\\MoA Service\\\\skills\\\\moa-service-client\\\\scripts\\\\moa_client.py\" wait MOA-11 --timeout 14400 --poll 20)",
      "PowerShell(python \"D:\\\\Desktop\\\\MoA Service\\\\skills\\\\moa-service-client\\\\scripts\\\\moa_client.py\" runs MOA-11)",
      "PowerShell(kubectl config current-context *)",
      "PowerShell(wsl -e sh -lc \"command -v kubectl || true; test -f ~/.kube/config && printf 'kubeconfig-present\\\\n' || true; test -f /home/kubeconfig/ai-prod.yaml && printf 'ai-prod-present\\\\n' || true\")",
      "PowerShell(wsl --list --verbose)",
      "PowerShell(docker context show *)",
      "PowerShell(ssh -i \"C:\\\\Users\\\\BW011541\\\\.ssh\\\\moa-service-readonly\" -o BatchMode=yes -o ConnectTimeout=10 192.168.0.130 \"pwd\")",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

4. Submit a real but bounded design using a fixed repository commit. Persist the new `designId`; do not judge a changed route by an older run because model routing is snapshotted when a run is created.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires access to environment variables, local files, and the network, but it does not declare an explicit tool/permission scope. That creates an overbroad and ambiguous trust boundary: an agent may use sensitive capabilities such as reading credentials.local.env or making outbound requests without a machine-readable restriction layer. In this context, the risk is elevated because the skill explicitly instructs the agent to retrieve a bearer token and contact an internal HTTP service, so undeclared capabilities could enable credential exposure or unintended data access if the skill is misused or the runtime grants broad defaults.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default prompt is written as a generic trigger to submit a technical-design task to the service and monitor it through completion, but it does not constrain who may invoke it, what kinds of tasks are in scope, or what repository or artifact boundaries must be enforced. In a skill that can call an internal service and download verified artifacts, broad implicit invocation increases the chance of unintended use, overreach into sensitive repositories or workflows, and unsafe agent delegation without explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The create payload includes the full prompt text, repository URLs, commit identifiers, and optional callback URL, and this payload is sent in POST requests to the MOA service. While network transmission is central to the client's purpose, the code lacks an explicit warning or disclosure that local prompt contents and repo metadata are sent to a remote service.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The result path creates directories and writes downloaded artifacts to the user-supplied output directory, but this operation has no confirmation prompt and no explicit user-facing warning near the write itself. For a code file, file writes should have some visible disclosure unless clearly documented elsewhere; this file only implies the behavior through the command name and argument structure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The client exposes administrative and diagnostic endpoints such as model-center and admin design-run access that go beyond the stated skill scope of design execution and artifact retrieval. In an agent setting, this expands available authority and can enable unintended information access or state-changing admin actions if the caller has a valid token.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The models command can invoke POST /v1/admin/model-center/models/refresh, which is a server-side administrative mutation unrelated to the declared user-facing workflow. Even if protected by server auth, bundling this into a general-purpose skill increases the chance an agent triggers privileged operations outside intended scope.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This markdown file is in scope for natural-language policy checks. The document consistently prescribes English command names and status labels such as `READY_FOR_REVIEW` and does not indicate whether operators may use another language or locale, which can conflict with a language-choice policy when no opt-in is provided.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The runs command accesses /v1/admin/designs/{design_id}/runs, exposing administrative per-invocation records beyond the manifest's stated design execution workflow. This may reveal internal operational metadata, failure details, or other sensitive run information to callers who only need high-level status/result access.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: .claude/settings.local.json:12