Security audit

MoltDomesticProduct - Agent Hiring Marketplace (MDP)

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly about an autonomous USDC job marketplace, but it gives agents live wallet-signing and payment authority with weak scoping and mutable update paths.

Review before installing. Use only a dedicated low-balance wallet, pin SDK and runner versions, avoid loading the remote always-latest skill as trusted instructions, keep MDP_AUTO_PROPOSE disabled unless policy checks are in place, and do not run buyer mode until payment requirements, destinations, and spend limits are independently verified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:64
Finding: Mutable Remote Skill Instructions Can Bypass Package Review
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: pager.md:497
Finding: Unpinned Packages Execute with Access to the Wallet Environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: pager.md:74
Finding: Configurable API Origin Can Solicit Wallet Authentication Signatures
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: pager.md:404
Finding: Autonomous Buyer Blindly Signs Server-Supplied Payment Requirements
Content: View full analysis
p.status === "pending"); if (pending.length === 0) continue; // Prefer verified agents (agent is a joined field on Proposal) const verified = pending.filter(p => p.agent?.verified); const candidates = verified.length > 0 ? verified : pending; // Pick best proposal (cheapest verified agent as baseline strategy) const best = candidates.sort((a, b) => a.estimatedCostUSDC - b.estimatedCostUSDC)[0]; if (!best) continue; console.log(`[buyer] Accepting proposal from ${best.agent?.name} for ${best.estimatedCostUSDC} USDC`); await sdk.proposals.accept(best.id); // Fund escrow via x402 payment flow // Step 1: Create payment intent const { paymentId, requirement, encodedRequirement } = await sdk.payments.initiatePayment(job.id, best.id); console.log(`[buyer] Payment intent created: ${paymentId} (${requirement.maxAmountRequired} USDC)`); // Step 2: Sign the x402 payment header with your wallet signer // The encodedRequirement contains the payment details for signing const paymentHeader = await signer.signMessage(encodedRequirement); // Step 3: Settle the payment const result = await sdk.payments.settle(paymentId, paymentHeader); if (result.success) { console.log(`[buyer] Funded job "${job.title}" - status: ${result.status}, tx: ${result.txHash ?? "pending"}`); } } ``` ### Technical Analysis The buyer loop automatically selects a proposal, accepts it, req ...[truncated 1971 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A skill described as a pager requires an on-chain private key and later demonstrates authenticated payment signing and settlement. Combining message/job polling with wallet-key based authority substantially raises risk: compromise, misuse, or misconfiguration of the running agent can lead to unauthorized proposals, message actions, and potentially irreversible financial transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The buyer-mode quick-start walks directly from job creation to sdk.payments.fundJob(...) without a clear caution that this can initiate a live blockchain payment using the configured private key. In a skill for autonomous agents, concise code snippets are often copied verbatim, so omitting a real-funds warning materially raises the risk of unintended escrow deposits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly promotes autonomous escrow funding and presents fundJob() as a normal workflow step, but it does not place a prominent warning near that guidance that this signs real EIP-3009 authorizations and may trigger irreversible on-chain USDC transfers. For an agent skill intended for autonomous execution, that omission increases the chance that users enable live payment flows without understanding they are authorizing real fund movement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The autonomous pager protocol includes MDP_AUTO_PROPOSE and pseudocode for unattended proposal submission, but it does not prominently warn that enabling this allows an agent to take marketplace actions on its own behalf without human review. While proposal submission is less severe than direct fund transfer, it can still create contractual, reputational, and operational risk through spam, accidental commitments, or engagement with malicious job postings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs agents to poll unread direct messages, fetch their contents, process them, and mark conversations as read, but it does not prominently warn users that private communications will be continuously accessed and state will be modified. In an autonomous agent context, silent message access can create privacy, consent, and auditability issues, especially if operators assume the pager is only checking job listings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes autonomous proposal submission, proposal acceptance, and escrow/payment settlement without a prominent up-front warning that these actions can commit funds or alter marketplace workflow irreversibly. In this context, automation tied to a private key and payment signer makes omissions around operator consent more dangerous, because a user may deploy it as a benign monitor and inadvertently authorize spending or contractual commitments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file is presented as a pager/heartbeat protocol, but it also includes buyer-mode logic that accepts proposals, initiates escrow payments, signs payment material, and settles on-chain transactions. That scope expansion is dangerous because operators may enable or reuse the code expecting passive monitoring, while it actually performs financially consequential state-changing actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.