T08 · Insecure Dependencies
Error
- Location
SKILL.md:41- Finding
Unpinned Third-Party Package Execution with Cryptocurrency Private-Key Access
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltMoon Crypto Launcher
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent MoltMoon crypto-operations runbook, but it combines unpinned npm execution with raw wallet private keys and live mainnet transaction commands.
Review carefully before installing. Use only a pinned, reviewed SDK version in an isolated environment, avoid passing private keys on the command line, use a low-balance operational wallet, and require explicit human review of chain, signer, amounts, approvals, and transaction calldata before any live Base mainnet write.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill repeatedly instructs operators to execute
npx -y @moltmoon/sdkwithout pinning an exact package version. That causes the agent or user to fetch and run whatever code is currently published under that package name, creating a supply-chain execution risk if a malicious or compromised release is published.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to provide a private key via environment variable or
--private-keyCLI flag but does not explicitly warn that CLI arguments may be exposed through shell history, process listings, logs, or agent telemetry. In a crypto-operational skill, poor secret handling can directly lead to wallet compromise and loss of funds.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This command executes an unpinned package directly from the registry, so the actual code run can change over time without any change to the skill file. In a blockchain operations skill that also handles private keys and transaction flows, that greatly increases the consequences of a supply-chain compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The runbooks include live launch, buy, sell, reward claim, and migration commands that perform irreversible mainnet write actions, but they do not prominently warn that these spend real funds and submit real blockchain transactions. In an agent-facing skill, that omission increases the chance of accidental execution, especially because dry-run and live examples are presented close together.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
An unversioned
npxcommand introduces time-of-use dependency drift and remote code execution from npm. Because this skill is intended for end-to-end live token launch operations, a compromised package could steal keys, alter transaction parameters, or submit unintended transactions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The command runs code fetched from npm at execution time without version pinning, so future runs may execute different code than what was originally validated. In a trading context, that enables supply-chain attacks to manipulate quotes, approvals, or transaction destinations.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This unpinned package execution is dangerous because it combines remote code retrieval with financial actions on mainnet. If the package is hijacked or a malicious version is published, operators could unknowingly run hostile code with wallet credentials available.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Executing an unpinned npm package for sell operations creates a supply-chain risk with direct financial consequences. A malicious update could change approval targets, amounts, or exfiltrate sensitive material from the environment.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Because the package version is not fixed, the behavior of this sell flow is mutable and controlled by the current npm publication state. In crypto transaction workflows, that turns a documentation example into a remote code execution and fund-loss risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Although this example is read-oriented, it still runs unpinned code from npm and therefore exposes operators to arbitrary code execution. The immediate transactional risk is somewhat lower than write actions, but credential theft or environment inspection would still be possible.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This command executes an unreviewed latest package release in a reward-claim flow, which is an on-chain write action. A compromised package could redirect claims, alter transaction data, or exfiltrate secrets before submission.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Even though migration-status is a read/check flow, using
npxwithout a version pin still downloads and executes mutable remote code. That presents a real supply-chain risk, especially in an environment where wallet secrets may already be configured.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This migration command combines unpinned remote package execution with approval and token migration operations, making supply-chain compromise especially severe. An attacker controlling a published version could induce approvals, alter migration behavior, or steal funds.
- Content
Static analysis
No suspicious patterns detected.