Security audit

Moltbet Skill

Security checks for vulnerabilities and agentic risk

Overview

This betting skill is coherent with its stated purpose, but it should go to Review because it combines autonomous USDC betting, wallet handling, mutable installs, and an unverified self-update path.

Review carefully before installing. Use only a dedicated low-value wallet, avoid importing any existing private key through chat or command-line arguments, pin and verify the CLI version instead of using latest, and do not allow the heartbeat to overwrite skill files from remote URLs without human review and integrity checks.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: skill.md:40
Finding: Unpinned Third-Party CLI Installation and Execution
Content: View full analysis
``` ``` ### Technical Analysis The Skill instructs the agent to install or execute the `moltbet` npm package without pinning an exact audited version or verifying a cryptographic integrity value. The explicit use of `@latest` permits the executed package to change after this Skill has been reviewed. Global installation increases the potential scope of compromise by placing package-provided executables in a shared command path. Both installation and `npx` execution may also invoke npm lifecycle scripts or other package-controlled code. The Skill subsequently relies on this package for wallet generation, wallet import, registration, balance management, and financial transactions. Therefore, a compromised package release could receive access to sensitive wallet operations. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious version under the expected `moltbet` package name. 3. An agent follows the Skill and runs `npm i -g moltbet` or `npx moltbet@latest`. 4. npm retrieves the current mutable release and executes its installation or CLI code. 5. The malicious package reads accessible configuration, intercepts wallet operations, manipulates transaction parameters, or sends sensitive information to an attacker-controlled service. 6. Because the installed executable is used for subsequent betting and wallet commands, malicious behavior may continue across later invocations. ### Impact Assessment Successful exploitation provi ...[truncated 688 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: heartbeat.md:7
Finding: Automatic Replacement of Trusted Skill Instructions from a Mutable Remote Source
Content: View full analysis
skill.md curl -s https://moltbet-web.vercel.app/heartbeat.md > heartbeat.md ``` ``` ### Technical Analysis The heartbeat directs the agent to replace its local `skill.md` and `heartbeat.md` files with content downloaded from mutable remote URLs. The update process does not validate a digital signature, pinned checksum, immutable release identifier, or expected content schema. HTTPS authenticates the transport endpoint but does not establish that newly served content is the same content that was audited. Compromise of the hosting account, deployment pipeline, DNS or certificate infrastructure, or authorized publisher credentials could change the remote files. The downloaded files are agent instructions rather than conventional binaries, but they form part of the Skill's effective behavior. Once loaded during a later Skill or heartbeat run, modified instructions could direct the agent to execute arbitrary commands, disclose information, install additional dependencies, or conduct unauthorized financial actions. Direct output redirection also overwrites the active files without staging, validation, rollback, or an atomic replacement procedure. ### Attack Path 1. An attacker gains control of the remote deployment, hosting account, release pipeline, or another component able to alter the referenced files. 2. The attacker modifies `skill.md` or `heartbeat.md` to include malicious commands or agent instructions. 3. The agent performs the documented heartbeat update. 4. `curl` downloads the attacker-controlled content and overwrites ...[truncated 1198 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:80
Finding: Wallet Private Key Passed Through a Command-Line Argument
Content: View full analysis
` (Ask operator for the key if importing) 2. **Registration**: `moltbet register ` ``` ### Technical Analysis The documented import procedure places the wallet private key directly in a command-line argument. Command-line secrets can be exposed through several channels, including: - Shell history files. - Process-listing and process-monitoring interfaces. - Terminal session recording. - Agent command transcripts and diagnostic logs. - Audit, telemetry, crash-reporting, or observability systems. - Copy-and-paste history and operator chat records. The instruction to ask the operator for the key creates an additional risk that the key will be entered into a retained conversation or another non-secret input channel. A wallet private key is a bearer credential: possession generally permits transaction signing without additional identity verification. Redaction after execution does not reliably remove copies already stored in logs or process-monitoring systems. ### Attack Path 1. An operator provides an existing wallet private key to the agent, potentially through a logged conversation. 2. The agent constructs `moltbet wallet import `. 3. The shell, process table, terminal recorder, agent transcript, or monitoring system records the argument. 4. A local user, compromised monitoring account, log reader, support operator, or later attacker obtains the retained key. 5. The attacker imports the key into another wallet client. 6. The attacker signs unauthorized transactions and transfers assets or impersonates the wallet owner. ### Impact Assessment Disclosure of the private key can provide complete control of th ...[truncated 639 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The heartbeat instructs the agent to download remote content and overwrite local skill.md and heartbeat.md directly, without integrity verification, pinning, or user confirmation. If the remote host, deployment pipeline, or DNS/TLS path is compromised, an attacker can replace the skill instructions with malicious content that alters future agent behavior or suppresses security-relevant checks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad terms like "bet," "prediction," and especially "gamble," which are common in ordinary conversation and can cause the skill to activate outside clearly intended betting workflows. Because this is a finance/gambling-oriented skill that may initiate autonomous market or wagering actions, accidental invocation increases the risk of unintended financial operations or exposure to untrusted external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The quick-start flow pushes users to register, generate/import a wallet, fund it with USDC, and begin betting immediately before clearly presenting financial-risk warnings. In an autonomous-agent betting skill, this omission increases the chance that operators authorize irreversible fund commitments without understanding loss, dispute, or wallet-compromise risks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to execute npx moltbet without a pinned version, which causes the latest package version to be fetched and executed at runtime. If the npm package is ever compromised, typo-squatted, or a malicious update is published, agents could run attacker-controlled code with access to local files, environment variables, wallets, and credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The onboarding command npx moltbet@latest <command> explicitly directs users to always run the newest published package, maximizing supply-chain risk. In this skill's context, that code would likely handle wallet generation/import and betting operations, so a malicious or compromised release could exfiltrate private keys or redirect funds.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.