T08 · Insecure Dependencies
Warning
- Location
SKILL.md:216- Finding
Unpinned Packages Are Installed from Mutable Third-Party Sources
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltbank
Security checks for vulnerabilities and agentic risk
Overview
This finance skill is mostly transparent about its purpose, but it uses high-impact money-movement authority with unsafe setup and command-construction patterns that warrant review before installation.
Review this carefully before installing. Only use it with a Moltbank account and agent profile you intend to grant finance permissions to, verify any browser approval URL is on app.moltbank.bot, avoid untrusted profile names or shell metacharacters, and prefer pinned or otherwise verified installation of the CLI and skill where your runtime supports it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:81- Finding
Shell Command Injection Through User-Controlled Agent Profile Names
- Content
View full analysis
" --json`. The output JSON contains `credentialsPath`, `verification_uri_complete`, and `user_code`. The CLI rejects malformed or off-host URLs before returning, so a JSON success exit means the URL is safe to show. c. Show the URL and code to the user; tell them to verify the domain is `app.moltbank.bot` before opening it. d. Run `export MOLTBANK_CREDENTIALS_PATH=""` in the session shell. e. Ask the user to approve in the browser and reply `done`. f. Run `moltbank auth poll --json` to finalize the session. To rename an agent later, run `moltbank agent rename --name "" --json`. ``` ### Technical Analysis The profile name and replacement name originate from chat input and are inserted into shell command examples inside double quotes. The documented validation only imposes a length of 1–64 characters. It does not prohibit double quotes, command substitutions, shell expansions, redirection operators, or other metacharacters. Quoting an interpolated value with double quotes is insufficient when the value itself can contain quote-breaking syntax or command substitutions. Shell parsing occurs before the Moltbank CLI receives the argument, so CLI-side validation cannot prevent commands injected at the shell layer. The credentials-path export is also constructed from command output. Although the Skill says that the profile pa ...[truncated 1374 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md * Do not install this skill or the `moltbank` CLI unless the user explicitly approves it. * Do not invent custom install commands when a platform-declared install flow exists. * Do not state that setup succeeded unless command output in this session confirms it. * Keep secrets local; never print full tokens, access tokens, or private keys.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md For any account-scoped action that needs a sender or Safe address: 1. If `accountName` is known, resolve the account internally (`moltbank account details --json`). 2. Do not ask the user for a raw Safe address when `accountName` is already known. 3. Ask for raw addresses only when no account context is available. ## Update-Required Handling
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
This is the same unpinned
npx skillsinvocation in a security-sensitive onboarding path. Because the skill also handles authentication and financial operations, any compromise in the bootstrap helper increases exposure to credential theft or arbitrary command execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
npx skills add moltbankhq/moltbank-skillis an unpinned runtime/package reference that can resolve to changing code. In the context of installing an agent skill, this could silently introduce a malicious or unexpected version of the installer or dependency chain.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The dependency setup section again directs use of
npx skillswithout version pinning. Repetition of the same pattern in multiple setup paths broadens the attack surface and makes compromise more likely in real use, especially since this skill operates with finance-related privileges.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest description says only 'CLI-first + optional local MCP bridge guidance' while the broader skill metadata advertises treasury management, payment approvals, purchases, and trading functions. For a finance-capable skill, understating or omitting sensitive operational capabilities can mislead users, reviewers, or policy engines about the true privilege and risk profile, increasing the chance of unsafe approval or deployment.
- Content