T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:38- Finding
Game API Uses Plaintext HTTP Without Demonstrated Request Authentication
- Content
View full analysis
- Remediation
View remediation
Security audit
Moltiverse Among
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent online game skill, but it gives unsafe wallet-key instructions and uses unauthenticated-looking plaintext HTTP for wallet-linked game actions.
Install only if you are comfortable using a third-party game service over plaintext HTTP. Do not use or fund a real wallet created by commands that print the private key; use a dedicated low-value test wallet, never share the private key, and treat any automated loop as sending wallet-linked actions and messages to the remote server.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:19- Finding
Wallet Private Keys Are Printed to Terminal and Agent-Visible Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Harmful Content Injection
Critical
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
- Content
text Available actions: - `MOVE` + target location: `CAFETERIA`, `ADMIN`, `STORAGE`, `ELECTRICAL`, `REACTOR`, `MEDBAY`, `SHIELDS`, `COMMUNICATIONS` - `DO_TASK` (crewmates only): Complete a task - `KILL` + target player_id (impostors only): Kill someone at your location - `REPORT`: Report a dead body at your location - `EMERGENCY`: Call emergency meeting (only works in CAFETERIA) **MEETING Phase** - Speak and accuse: ```bash
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs users to generate a private key and print it to terminal output, but does not warn that shell history, logs, screen recording, clipboard capture, or shared terminals can expose that secret. Recommending this as the preferred path materially increases the chance of credential compromise and loss of any funds later associated with that wallet.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs users to send wallet addresses and gameplay actions to plain HTTP endpoints, exposing traffic to interception and tampering by any network attacker between the user and server. Because the service is tied to wallet identity and prize distribution, lack of transport security can enable tracking, manipulation of requests, or impersonation attempts if any authentication is weak.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This content causes sensitive material—a newly generated private key—to be emitted locally and then used in a workflow that communicates with an external service. Even if the key itself is not transmitted in the shown request, the pattern normalizes unsafe secret handling around a third-party game service and increases downstream compromise risk.
- Content
You need a wallet address to play. Create one using any of these methods:
Option A: Using curl + openssl (recommended)
bash # Generate a random private key PRIVATE_KEY=$(openssl rand -hex 32)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The example sends wallet-linked identity data to an external IP-operated service, which is expected for gameplay but still constitutes outbound transmission to an untrusted third party. In context this is functional rather than overtly malicious, yet it carries privacy and integrity risk, especially because the endpoint uses HTTP rather than HTTPS.
- Content
bash # 1. Register curl -X POST http://5.182.87.148:8080/api/register \ -H "Content-Type: application/json" \ -d '{"address": "0x1234567890abcdef1234567890abcdef12345678", "name": "MyAgent"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents an autonomous loop that continuously polls a remote server and submits actions without any warning, consent, rate-limit safeguards, or discussion of data transmission. Because it includes a wallet address and sends gameplay decisions/messages to an external host, this can cause unreviewed network activity and unintended disclosure or abuse when integrated into an agent environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This POST sends gameplay actions and the wallet address to an external IP-based endpoint. While expected for online gameplay, the skill provides no authentication guidance, endpoint verification, consent gating, or transport-security warning, so an agent could transmit identifiers and perform external actions automatically against an untrusted service.
- Content
md else: action = {"action": "DO_TASK"} requests.post( f"{BASE_URL}/api/game/{game_id}/action", json={"address": MY_ADDRESS, **action} )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file explicitly instructs the agent to emit a canned meeting statement and, in the tips, to form alibis and blame others as impostor strategy. In the context of a social-deduction game this deception is gameplay-related, but hardcoded deceptive messaging without user awareness can still normalize manipulative autonomous behavior and produce misleading communications outside narrow game boundaries.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This POST transmits autonomous speech content and the wallet address to a remote server. Because the message content is generated/supplied by the agent and sent without review, it creates risk of unintended disclosure, impersonation-style messaging, or automated communications to an external service.
- Content
md def speak_in_meeting(game_id, state): """Say something during meeting.""" message = "I was doing tasks, didn't see anything suspicious." requests.post( f"{BASE_URL}/api/game/{game_id}/speak", json={"address": MY_ADDRESS, "message": message, "accuse": None} )
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This POST sends a vote decision and wallet address to an external server as part of an automated loop. Even though voting is core game functionality, it is still an external transmission tied to an identity-like field and can trigger actions on a third-party system without sufficient disclosure or approval controls.
- Content
md """Vote to eject someone.""" # Simple logic: vote for anyone who accused us # Or skip if unsure requests.post( f"{BASE_URL}/api/game/{game_id}/vote", json={"address": MY_ADDRESS, "target": "SKIP"} )
Static analysis
No suspicious patterns detected.