Autonomous Agent Skills

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:05 AM UTC
• Version: 2.1.1

Overview

This finance/payment skill includes expected wallet and x402 payment code, but it also bundles unrelated social-network instructions and broad crypto transaction helpers that are not tightly scoped.

Install only if you intentionally want an autonomous finance agent that can create and use local crypto wallets for paid MCP tools, and review or remove the bundled Moltbook files and broad transfer/swap/contract helpers first. Use dedicated low-balance wallets, avoid mainnet keys unless necessary, require human confirmation for any transaction, and do not allow runtime self-updates from remote curl downloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (58)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and documents powerful capabilities including environment access, MCP/network use, and shell/CLI operations, but does not declare permissions. That prevents meaningful consent and review, especially because the documented commands can create wallets, move assets, and interact with external services. In an autonomous-agent marketplace, undeclared execution and network capabilities materially increase abuse risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior substantially exceeds the stated purpose: beyond paid MCP calls, it includes wallet management, funding, transfers, swaps, arbitrary contract interaction, and multi-chain operations. This mismatch can mislead users and higher-level agents into invoking a financial-operations skill they believe is narrowly scoped, when it can in fact perform broad asset-moving actions. In an autonomous setting, that scope gap is especially dangerous because orchestration logic may trust the description for safety boundaries.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The heartbeat grants broad DM, posting, feed-browsing, and social engagement behavior that is unrelated to the stated financial/x402 functionality of the autonomous-agent skill. In an autonomous marketplace setting, this materially expands the agent’s authority and outbound communication surface, enabling unsolicited interaction, data leakage, manipulation, or reputation abuse under the cover of routine heartbeat behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The file instructs the agent to fetch updated skill content from a remote website and overwrite local skill files during heartbeat. This creates an untrusted remote update channel that can silently change the agent’s behavior over time, bypassing normal review and allowing compromise if the remote endpoint or supply chain is tampered with.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This file documents a private inter-agent messaging capability that is outside the stated purpose of the autonomous-agent skill, which is focused on finance/x402 tools such as predictions, backtests, bank linking, and scoring. Adding a covert or secondary communication channel increases the attack surface for prompt injection, data exfiltration, unauthorized coordination with external agents, and social-engineering workflows, especially because it instructs the agent to poll on heartbeat and autonomously respond or escalate messages.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly tells agents to persist an API key to a local credentials file, memory, or environment variables. While credential storage is operationally common, this expands the skill from social-network API usage into secret persistence guidance and increases exposure if the agent environment is shared, logged, synced, or later accessed by other skills/tools.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest description omits local wallet management and blockchain asset operations that the body of the skill instructs the agent to perform. Users and automated installers may therefore authorize the skill without understanding that it handles wallets, balances, and funding workflows tied to spendable assets. That is a transparency and informed-consent failure for a finance-related skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes transfer and token-swap capabilities that are absent from the manifest description, which understates the skill's financial authority. Hidden or downplayed transfer/swap features create a realistic risk of unauthorized or accidental movement of user funds, especially if another agent selects the skill based only on metadata. In this financial context, omitted asset-movement capabilities are materially dangerous.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: This file exposes local tools that can create wallets and guide or trigger funding flows, which expands the skill’s effective capability beyond passive balance checks or payment retries. In an autonomous-agent marketplace context, hidden or under-declared wallet-management actions are risky because an agent may invoke them without a user fully understanding that new cryptographic identities and payment flows are being created on the host system.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The credit_aptos_wallet tool can directly call the Aptos devnet faucet and fund a locally configured wallet. Even though it is limited to devnet, this is still an externally effectful financial/network action that can be abused by an autonomous agent to create and provision wallets without clear operator approval, increasing the chance of unauthorized resource use and masking broader payment-flow behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The CLI exposes commands for wallet attestation, setup, balances, transfers, contracts, and swaps that go beyond the narrowly described MCP tool surface of predictions, backtests, bank linking, and scoring. In an autonomous-agent marketplace context, this increases the skill’s effective privilege and creates a capability mismatch that can lead users or agents to invoke sensitive blockchain operations they did not expect from the manifest description.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The presence of direct asset-management commands such as balance, transfer, contract, and swap gives the skill the ability to inspect and move on-chain assets, which is significantly more dangerous than the stated autonomous-agent MCP workflow. In a system where agents may download and invoke skills autonomously, this mismatch is especially risky because it can enable unintended fund movement or contract interaction under the guise of a prediction/score skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a fully generic EVM contract caller that can invoke arbitrary functions on arbitrary contracts and send ETH, which materially exceeds the skill’s declared purpose of payment-protected prediction, backtest, bank-linking, and scoring tools. In an autonomous-agent marketplace context, this gives downloaded agents a broad wallet-spending primitive that can be repurposed for transfers, approvals, malicious contract interactions, or unintended asset movements.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The write path submits arbitrary onchain transactions using user wallet credentials, with caller-controlled contract address, function signature, arguments, gas, and optional ETH value. For a skill intended to expose a narrow set of finance tools, this creates an unjustified arbitrary write capability that can be exploited to drain funds, grant token approvals, or interact with malicious contracts if an autonomous agent invokes it.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The code claims to determine read-only behavior but actually uses a name-prefix heuristic such as 'balanceOf' or 'get', which is not a reliable indicator of Solidity mutability. A state-changing function with a benign-looking name could be misclassified, causing the tool to treat dangerous operations as reads and weakening safety expectations around what the tool may execute.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This standalone script accepts a private key from an environment variable or local wallet storage and uses it to sign an on-chain transaction. Even though this may be intended for legitimate wallet setup, it expands the skill's capability into direct secret handling and transaction signing, which is sensitive and not clearly aligned with the described MCP toolset; in autonomous-agent contexts, such code increases the risk of key misuse, accidental exposure, or unauthorized transfers if invoked by other components.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This file implements direct token swap functionality, including quote retrieval, transaction assembly, ERC-20 approvals, and on-chain transaction submission, but the skill metadata only describes x402 payment-protected financial data, scoring, and bank-linking tools. That mismatch is dangerous in an autonomous skill marketplace because agents may import the skill expecting data services while receiving undeclared asset-moving capability that can spend user funds.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code performs sensitive blockchain actions not disclosed by the manifest: it approves ERC-20 spenders and submits swap transactions using the local wallet. Hidden transaction-execution capability increases the risk of unauthorized or unexpected fund movement, especially when consumed by autonomous agents that rely on manifest descriptions for trust and scope decisions.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a standalone cryptocurrency transfer utility capable of sending native assets and arbitrary ERC20 tokens from the local wallet to any address. That capability is materially broader than the skill’s declared x402 payment, scoring, and backtest functions, creating a dangerous hidden fund-movement primitive that an autonomous agent or downstream integrator could invoke to exfiltrate funds.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The execution path directly submits native-token or ERC20 transfer transactions using user wallet credentials, with attacker-controlled recipient, amount, and token parameters. In the context of an autonomously downloadable agent skill, this is a general-purpose asset transfer mechanism that could be abused to drain wallets or redirect funds under the guise of normal skill operation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown directs overwriting local skill files with content downloaded via curl, but provides no explicit warning that this replaces existing trusted instructions. In practice, this encourages silent modification of executable agent guidance, increasing the risk of persistence, downgrade, or malicious instruction injection through a compromised remote source.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The heartbeat embeds repeated authenticated network calls using a bearer API key to retrieve status, DMs, and conversations, yet gives no warning about transmitting credentials or accessing private message content. In an autonomous agent context, this normalizes sensitive outbound requests and private-data handling without clear consent, minimization, or privacy controls.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The skill says the human can ask the agent to do 'anything on Moltbook' and that it should act without waiting for heartbeat. This broad trigger language can cause over-activation of the skill and unreviewed execution of posting, voting, following, or other authenticated actions from casual user prompts, especially in autonomous or tool-rich environments.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "upvote" is overly generic and can match ordinary user requests that are not intended to invoke this specific skill. In an autonomous agent marketplace, this can cause unintended activation of a social-network skill, leading the agent to perform actions such as voting or interacting with external services without clear user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises bank-account linking and score-by-email features, which involve sensitive financial and personal data, but does not clearly warn users about privacy, consent, data handling, or operational safeguards. In an autonomous-agent context, this is more dangerous because agents may invoke these capabilities programmatically without a human noticing that regulated or highly sensitive data is being processed.

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/cli.js:38

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/credit-aptos-agent.js:56

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/check-update.js:39

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/agent/llm.js:3

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/agent/tools/localTools.js:110

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/attest-aptos-wallet.js:58

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/generate-facilitator-keys.js:69

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/lib/wallet.js:40

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/register-aptos-agent.js:50

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/setup-aptos.js:21

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/setup-evm-multichain.js:123