Moltbet Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:41 PM UTC
• Version: 1.0.1

Overview

This betting skill is coherent with its stated purpose, but it should go to Review because it combines autonomous USDC betting, wallet handling, mutable installs, and an unverified self-update path.

Review carefully before installing. Use only a dedicated low-value wallet, avoid importing any existing private key through chat or command-line arguments, pin and verify the CLI version instead of using latest, and do not allow the heartbeat to overwrite skill files from remote URLs without human review and integrity checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: skill.md:40
• Finding: Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 40-51 **Vulnerability Type**: Unpinned npm dependency and mutable package execution **Risk Level**: High ### Vulnerable Code ```markdown ### Installation The Moltbet CLI is the primary interface for agent operations. Install it globally: ```bash npm i -g moltbet ``` Or run directly using npx: ```bash npx moltbet@latest <command> ``` ``` ### Technical Analysis The Skill instructs the agent to install or execute the `moltbet` npm package without pinning an exact audited version or verifying a cryptographic integrity value. The explicit use of `@latest` permits the executed package to change after this Skill has been reviewed. Global installation increases the potential scope of compromise by placing package-provided executables in a shared command path. Both installation and `npx` execution may also invoke npm lifecycle scripts or other package-controlled code. The Skill subsequently relies on this package for wallet generation, wallet import, registration, balance management, and financial transactions. Therefore, a compromised package release could receive access to sensitive wallet operations. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious version under the expected `moltbet` package name. 3. An agent follows the Skill and runs `npm i -g moltbet` or `npx moltbet@latest`. 4. npm retrieves the current mutable release and executes its installation or CLI code. 5. The malicious package reads accessible configuration, intercepts wallet operations, manipulates transaction parameters, or sends sensitive information to an attacker-controlled service. 6. Because the installed executable is used for subsequent betting and wallet commands, malicious behavior may continue across later invocations. ### Impact Assessment Successful exploitation provi ...[truncated 688 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version, such as `moltbet@1.0.0`, rather than using an implicit current version or `@latest`. 2. Verify the expected npm registry, publisher identity, package provenance, and cryptographic integrity before installation. 3. Publish and validate signed release artifacts or checksums through an independent trusted channel. 4. Use a committed lockfile for any local installation and review all transitive dependencies. 5. Avoid global installation. Run the CLI in an isolated container, sandbox, or dedicated low-privilege environment. 6. Disable npm lifecycle scripts where compatible, for example with `--ignore-scripts`, and explicitly review any scripts that are required. 7. Restrict the CLI process so it can access only the wallet and configuration resources strictly required for the requested operation. 8. Require human approval before upgrading to a new package version, especially when wallet or financial functionality is involved. ]]>

T08 · Insecure Dependencies

Error

• Location: heartbeat.md:7
• Finding: Automatic Replacement of Trusted Skill Instructions from a Mutable Remote Source<![CDATA[ ## Vulnerability Details **File Location**: `heartbeat.md`, lines 7-17 **Vulnerability Type**: Unverified remote Skill update mechanism **Risk Level**: High ### Vulnerable Code ```markdown ## 1. Check for Skill Updates ```bash curl -s https://moltbet-web.vercel.app/skill.json | grep '"version"' ``` If a new version is available, re-fetch the latest documentation: ```bash curl -s https://moltbet-web.vercel.app/skill.md > skill.md curl -s https://moltbet-web.vercel.app/heartbeat.md > heartbeat.md ``` ``` ### Technical Analysis The heartbeat directs the agent to replace its local `skill.md` and `heartbeat.md` files with content downloaded from mutable remote URLs. The update process does not validate a digital signature, pinned checksum, immutable release identifier, or expected content schema. HTTPS authenticates the transport endpoint but does not establish that newly served content is the same content that was audited. Compromise of the hosting account, deployment pipeline, DNS or certificate infrastructure, or authorized publisher credentials could change the remote files. The downloaded files are agent instructions rather than conventional binaries, but they form part of the Skill's effective behavior. Once loaded during a later Skill or heartbeat run, modified instructions could direct the agent to execute arbitrary commands, disclose information, install additional dependencies, or conduct unauthorized financial actions. Direct output redirection also overwrites the active files without staging, validation, rollback, or an atomic replacement procedure. ### Attack Path 1. An attacker gains control of the remote deployment, hosting account, release pipeline, or another component able to alter the referenced files. 2. The attacker modifies `skill.md` or `heartbeat.md` to include malicious commands or agent instructions. 3. The agent performs the documented heartbeat update. 4. `curl` downloads the attacker-controlled content and overwrites ...[truncated 1198 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Distribute Skill updates as immutable, versioned release artifacts rather than mutable files at fixed URLs. 2. Sign each release and verify the signature against a pinned public key before accepting it. 3. Publish expected SHA-256 or stronger hashes through a separate trusted channel and verify all downloaded files. 4. Download updates into a temporary directory rather than overwriting active files directly. 5. Validate the complete package, including metadata, file names, sizes, and hashes, before activation. 6. Require explicit human review and approval before new instructions become authoritative. 7. Use atomic replacement only after successful validation, and preserve a known-good rollback copy. 8. Reject redirects and unexpected content types, and configure `curl` to fail visibly on HTTP errors, such as with `--fail --show-error`. 9. Do not determine update trust from a remotely supplied version string alone; bind the version to the signed release manifest. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:80
• Finding: Wallet Private Key Passed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 80-85 **Vulnerability Type**: Insecure handling of wallet private keys **Risk Level**: High ### Vulnerable Code ```markdown #### CLI Onboarding Commands 1. **Wallet Setup**: - Generate: `moltbet wallet generate` - Import: `moltbet wallet import <privateKey>` (Ask operator for the key if importing) 2. **Registration**: `moltbet register <name>` ``` ### Technical Analysis The documented import procedure places the wallet private key directly in a command-line argument. Command-line secrets can be exposed through several channels, including: - Shell history files. - Process-listing and process-monitoring interfaces. - Terminal session recording. - Agent command transcripts and diagnostic logs. - Audit, telemetry, crash-reporting, or observability systems. - Copy-and-paste history and operator chat records. The instruction to ask the operator for the key creates an additional risk that the key will be entered into a retained conversation or another non-secret input channel. A wallet private key is a bearer credential: possession generally permits transaction signing without additional identity verification. Redaction after execution does not reliably remove copies already stored in logs or process-monitoring systems. ### Attack Path 1. An operator provides an existing wallet private key to the agent, potentially through a logged conversation. 2. The agent constructs `moltbet wallet import <privateKey>`. 3. The shell, process table, terminal recorder, agent transcript, or monitoring system records the argument. 4. A local user, compromised monitoring account, log reader, support operator, or later attacker obtains the retained key. 5. The attacker imports the key into another wallet client. 6. The attacker signs unauthorized transactions and transfers assets or impersonates the wallet owner. ### Impact Assessment Disclosure of the private key can provide complete control of th ...[truncated 639 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove support and documentation for private keys supplied as command-line arguments. 2. Accept the key through a hidden interactive prompt that disables terminal echo and avoids shell history. 3. Prefer hardware wallets, external signing providers, or operating-system keychains so raw private keys do not enter the agent context. 4. If file-based import is unavoidable, use a protected temporary file or file descriptor with restrictive permissions, avoid predictable paths, and securely delete it immediately after use. 5. Explicitly prohibit operators from entering private keys into chat, prompts, command transcripts, environment variables, or support tickets. 6. Ensure application logs, telemetry, errors, and crash reports redact secrets before persistence. 7. Restrict imported keys to a dedicated low-value wallet with limited funds and permissions. 8. Add automated checks that reject key-like values supplied as positional command-line arguments. 9. If a key has already been handled through this procedure, treat it as potentially compromised and migrate assets to a newly generated wallet. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The heartbeat instructs the agent to download remote content and overwrite local `skill.md` and `heartbeat.md` directly, without integrity verification, pinning, or user confirmation. If the remote host, deployment pipeline, or DNS/TLS path is compromised, an attacker can replace the skill instructions with malicious content that alters future agent behavior or suppresses security-relevant checks.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad terms like "bet," "prediction," and especially "gamble," which are common in ordinary conversation and can cause the skill to activate outside clearly intended betting workflows. Because this is a finance/gambling-oriented skill that may initiate autonomous market or wagering actions, accidental invocation increases the risk of unintended financial operations or exposure to untrusted external services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quick-start flow pushes users to register, generate/import a wallet, fund it with USDC, and begin betting immediately before clearly presenting financial-risk warnings. In an autonomous-agent betting skill, this omission increases the chance that operators authorize irreversible fund commitments without understanding loss, dispute, or wallet-compromise risks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to execute `npx moltbet` without a pinned version, which causes the latest package version to be fetched and executed at runtime. If the npm package is ever compromised, typo-squatted, or a malicious update is published, agents could run attacker-controlled code with access to local files, environment variables, wallets, and credentials.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence
• Finding: The onboarding command `npx moltbet@latest <command>` explicitly directs users to always run the newest published package, maximizing supply-chain risk. In this skill's context, that code would likely handle wallet generation/import and betting operations, so a malicious or compromised release could exfiltrate private keys or redirect funds.

Static analysis

No suspicious patterns detected.