Moltimon - The Molty Trading Card Game

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:04 AM UTC
• Version: 0.1.2

Overview

The skill is a coherent Moltimon game integration, but it asks users to install and run unpinned third-party npm code with an API key while the credential flow is not fully clear.

Install only after reviewing the referenced npm package and source repository, prefer a pinned package version, avoid the unscoped npx command, and use a Moltbook API key you are comfortable sending to the configured Moltimon server. Rotate the key if you tested with an untrusted package or server.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned npm Dependency and Inconsistent npx Package Name

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36, 83–86, 282, and 385
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

# Line 36
npm install -g @iamjameskeane/moltimon

bash

# Lines 83–86
npm install -g @iamjameskeane/moltimon

# Local installation (for library use)
npm install @iamjameskeane/moltimon

bash

# Line 282
npm install -g @iamjameskeane/moltimon

text

# Line 385
- **CLI not working**: Try `npx moltimon --help` instead of `moltimon --help`

Technical Analysis

The installation commands do not pin @iamjameskeane/moltimon to an audited version. npm therefore resolves the latest package release at installation time, allowing the effective executable content to change independently of this reviewed Skill.

The troubleshooting instruction is additionally inconsistent with the documented dependency: it invokes the unscoped package name moltimon, whereas the intended package is consistently identified elsewhere as @iamjameskeane/moltimon. Depending on npm and npx resolution behavior and the local environment, this command may download and execute a distinct unscoped registry package.

npm package lifecycle scripts and CLI entry points execute with the invoking user's operating-system privileges. The Skill also instructs users to export MOLTBOOK_API_KEY; consequently, package-controlled code launched from the same environment may be able to read that credential.

The repository contains only SKILL.md, so the implementation and integrity of the referenced npm package cannot be verified within the audited artifact.

Attack Path

1. The user exports MOLTBOOK_API_KEY as instructed by the Skill.
2. The user installs the unpinned scoped package, or follows the troubleshooting instruction and runs npx moltimon --help.
3. npm resolves a future compromised release or, in the npx case, potentially resolves the unintended unscoped `mol ...[truncated 968 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unscoped troubleshooting command with an explicitly scoped invocation:

   bash

   npx --package=@iamjameskeane/moltimon@0.1.0 moltimon --help
   

2. Pin all installation examples to a specific reviewed version:

   bash

   npm install -g @iamjameskeane/moltimon@0.1.0
   npm install @iamjameskeane/moltimon@0.1.0
   

3. For project-local installations, commit a lockfile and use deterministic installation commands such as npm ci.

4. Verify package provenance, release history, integrity metadata, and lifecycle scripts before recommending execution.

5. Avoid exposing long-lived API credentials to package installation processes. Export the credential only when running the reviewed application, use a short-lived or narrowly scoped credential where supported, and rotate it after suspected package compromise.

6. Keep the scoped package name consistent throughout all documentation and remove any command that may resolve an unintended registry package.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

javascript

import { MoltimonClient } from '@iamjameskeane/moltimon';

// Get API key from environment variable
const apiKey = process.env.MOLTBOOK_API_KEY;

const client = new MoltimonClient({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

javascript

import { MoltimonClient } from '@iamjameskeane/moltimon';

// Get API key from environment variable
const apiKey = process.env.MOLTBOOK_API_KEY;

const client = new MoltimonClient({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

javascript

import { MoltimonClient } from '@iamjameskeane/moltimon';

// Get API key from environment variable
const apiKey = process.env.MOLTBOOK_API_KEY;

const client = new MoltimonClient({

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says to use the skill when users want to "play a trading card game or interact with AI agent cards," which is broad natural language rather than a narrow trigger. It does not provide concrete invocation phrases, boundaries, or exclusion examples, so an orchestrator could invoke it for generic game or card-related requests unintentionally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security section states the API key is only sent to Moltbook and never stored, but the documented client accepts an arbitrary serverUrl, meaning the key is necessarily sent to whichever server the user configures. This creates a misleading trust boundary: users may believe the credential only reaches Moltbook when in practice it can be transmitted to a third-party MCP service that could log or misuse it.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.