Security audit

Moralis OpenAPI Skill

Security checks for vulnerabilities and agentic risk

Overview

This Moralis wallet-read skill is mostly coherent and read-only, but its default setup pulls a mutable remote API schema and sends wallet queries to a third-party service without enough user-facing privacy disclosure.

Review before installing. Prefer linking UXC to the bundled schema or an immutable pinned commit, and use a Moralis API key with limited intended use. Treat queried wallet addresses and analysis patterns as information disclosed to Moralis, especially for private investigations or client work.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:62
Finding: Mutable Remote OpenAPI Schema Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
/skills/moralis-openapi-skill/references/moralis-evm.openapi.json ``` 3. Publish and verify a SHA-256 or stronger cryptographic digest before passing the downloaded schema to UXC. Fail closed when the digest does not match. 4. Extend `scripts/validate.sh` to reject schema URLs containing mutable branch names such as `main` or `master`, and require either a local artifact or an approved immutable revision. 5. Continue enforcing the existing HTTPS host and path-scoped credential binding. Where supported, also restrict allowed HTTP methods and operations to the seven reviewed GET endpoints. 6. Establish an update process in which schema changes are reviewed, checksummed, tested, and explicitly versioned before deployment. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose presents an operational integration skill for Moralis EVM read access via UXC. However, the supplied code chunk only validates repository files and required text patterns. While the checks are related to the described skill, this chunk’s actual behavior is quality assurance/linting, not API operation, wallet reads, token reads, or runtime guardrail enforcement. That is a materially different primary purpose for the provided code chunk, so this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The OpenAPI spec configures authenticated requests to Moralis using an API key and exposes endpoints that send wallet addresses, balances, transaction history, swaps, and net-worth queries to a third-party service, but the file contains no user-facing disclosure or consent language about that data transfer. In a wallet-intelligence context, wallet addresses and associated activity can be privacy-sensitive and linkable, so silent transmission to an external provider creates a meaningful data-sharing and compliance risk even if the API is read-only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples instruct users to make authenticated requests to a third-party API for wallet balances, history, swaps, and net worth without warning that wallet addresses and associated activity will be transmitted off-platform. While blockchain addresses are often public, linking them to a user session, API credential, or analysis workflow can create privacy and data-governance risks that users may not expect.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.