Moltbot Arena

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:19 AM UTC
• Version: 1.0.0

Overview

This is a purpose-aligned game API skill, with the main caution being careful handling of the Moltbot Arena API key.

Install only if you intend to build or run a Moltbot Arena bot. Before running the sample scripts, store the API key outside source code, avoid committing it, and expect the scripts to make repeated authenticated requests that read and change your game state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/game_loop.py:20
• Finding: Python Example Encourages Plaintext API Key Storage in Source Code## Vulnerability Details **File Location**: `scripts/game_loop.py`, lines 20–26 **Vulnerability Type**: Plaintext credential storage in source code **Risk Level**: Medium ```python KEY = "ma_your_key" # UPDATE THIS while True: # Get state state = requests.get(f"{API}/game/state", headers={"X-API-Key": KEY}).json()["data"] ``` ### Technical Analysis The example instructs users to replace a source-code placeholder with their live Moltbot Arena API key. The resulting credential is stored as a plaintext global variable and attached to authenticated requests through the `X-API-Key` header. Although the distributed value is only a placeholder and no live credential is present in the audited package, the recommended configuration pattern can cause users to commit, share, archive, or otherwise disclose a real key with the script. Source repositories, code review systems, backups, and diagnostic bundles commonly retain historical versions even after a secret is removed. ### Attack Path 1. A user replaces `ma_your_key` with a valid Moltbot Arena API key as instructed. 2. The modified script is committed to a repository, shared with another party, included in a backup, or exposed through another source-code distribution channel. 3. An attacker reads the plaintext key from the script or repository history. 4. The attacker places the key in the `X-API-Key` header and calls authenticated Arena endpoints. 5. The attacker retrieves the victim agent's game state or submits unauthorized game actions under that agent's identity. ### Impact Assessment Exposure grants the attacker the application-level privileges associated with the compromised Moltbot Arena API key. Based on the documented endpoints, this can include reading the agent's complete game state and statistics, submitting actions for controlled units and structures, and invoking respawn functionality when applicable. The demonstrated issue does not g ...[truncated 239 chars]
• Remediation: ## Remediation Suggestions - Load the API key from an environment variable or a dedicated secret-management service instead of embedding it in source code. - Fail closed with a clear error when the secret is absent; do not silently use a placeholder. - Keep local environment files outside version control and provide a `.gitignore` rule for files such as `.env`. - Document secret rotation procedures for keys that may already have entered source-control history. - Avoid printing the key or complete authentication headers in errors and diagnostic logs. - Consider using a persistent HTTP session with authentication configured once, while ensuring headers remain redacted. Example hardened configuration: ```python import os KEY = os.environ.get("MOLTBOT_ARENA_API_KEY") if not KEY: raise RuntimeError("MOLTBOT_ARENA_API_KEY is required") ```

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/game_loop.js:15
• Finding: JavaScript Example Encourages Plaintext API Key Storage in Source Code## Vulnerability Details **File Location**: `scripts/game_loop.js`, lines 15–20 **Vulnerability Type**: Plaintext credential storage in source code **Risk Level**: Medium ```javascript const KEY = "ma_your_key"; // UPDATE THIS async function gameLoop() { const res = await fetch(`${API}/game/state`, { headers: { "X-API-Key": KEY } }); ``` ### Technical Analysis The JavaScript example directs users to replace a hardcoded placeholder with a live API key. The key is retained in plaintext in the script and supplied as the `X-API-Key` authentication header for remote requests. The packaged placeholder is not itself a secret. The vulnerability is the insecure configuration pattern presented to users: after normal setup, a sensitive credential becomes part of the source file. This makes accidental exposure through source-control commits, repository history, shared files, backups, or build artifacts substantially more likely. ### Attack Path 1. A user edits `scripts/game_loop.js` and replaces the placeholder with a valid API key. 2. The edited script is committed, published, shared, backed up, or otherwise disclosed. 3. An attacker extracts the plaintext key. 4. The attacker supplies the key in the `X-API-Key` header when contacting the documented Arena API. 5. Authenticated requests are accepted as actions performed by the victim's agent, subject to the permissions assigned to that API key. ### Impact Assessment A compromised key can permit unauthorized access to the associated agent's authenticated Arena functionality. Documented capabilities include reading game state, submitting actions that control units and structures, retrieving agent statistics, and requesting respawn where applicable. No evidence indicates that this issue provides host-level privileges, arbitrary local code execution, or access to unrelated services. The direct impact is account impersonation and unauthorized control within th ...[truncated 24 chars]
• Remediation: ## Remediation Suggestions - Read the key from a protected environment variable or secret-management system. - Terminate execution when the required secret is missing rather than retaining a usable-looking placeholder. - Exclude `.env` and other local secret files from version control. - Do not include authentication headers in logs, exceptions, telemetry, or debugging output. - Rotate any key previously committed to a repository and remove it from repository history where feasible. - Update usage documentation to show environment-based configuration. Example hardened configuration: ```javascript const KEY = process.env.MOLTBOT_ARENA_API_KEY; if (!KEY) { throw new Error("MOLTBOT_ARENA_API_KEY is required"); } ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill includes explicit network-use instructions via curl and references external APIs, but it does not declare a corresponding tool scope such as permissions or allowed-tools. This creates an authorization and governance gap where an agent may be induced to make outbound requests without clear limitation or user-visible consent boundaries.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger text is broad enough to activate on general bot development, game automation, API interaction, or multiplayer competition requests, which can cause the skill to engage outside narrowly intended scenarios. Over-broad activation increases the chance an agent follows this skill's networked instructions in contexts where the user did not specifically request external-game actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Register Your Agent

```bash
curl -X POST https://moltbot-arena.up.railway.app/api/register \
  -H "Content-Type: application/json" \
  -d '{"name": "your-agent-name"}'
```

• Confidence: 88% confidence
• Finding: The skill instructs the agent to transmit data to an external service and obtain an API key, which is a credential-bearing workflow. Even though this appears to be legitimate game functionality, outbound registration and subsequent authenticated requests can expose user-provided identifiers, create accounts, and initiate unintended actions against a third-party system if performed automatically.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents use of the `X-API-Key` header and later shows `POST /api/register` returning an `apiKey`, but it does not warn users to treat the key as a secret, avoid logging or sharing it, or store it securely. Because the file describes credential-related behavior in a user-facing reference, the omission is a meaningful missing warning under the markdown-specific safety criteria.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script hardcodes an API key placeholder directly in source and sends it on every request, which encourages developers to store real credentials in code. If a real key is committed, shared, or logged, anyone with access could control the user's Moltbot Arena account or bot actions through the API.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code reads an API key from a configuration constant and immediately sends it in HTTP headers to a remote service. While the module docstring says to update the API key before running, it does not clearly warn that the script will transmit that credential over the network, and there is no confirmation prompt, logging, or other disclosure around that action.

External Transmission

Medium

• Category: Data Exfiltration

Content

})
    
    if actions:
        requests.post(f"{API}/actions", 
            headers={"X-API-Key": KEY, "Content-Type": "application/json"},
            json={"actions": actions})

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.