Security audit

MoltCredit

Security checks for vulnerabilities and agentic risk

Overview

MoltCredit is a disclosed networked credit and settlement tool, but it can make financial state changes with an API key without confirmation or strong input safeguards.

Install only if you trust the MoltCredit service and are comfortable giving scripts access to a MOLTCREDIT_API_KEY. Treat credit extension, transaction recording, and settlement as financial actions: review recipients, amounts, and currencies manually, avoid attacker-supplied agent names or limits, and consider adding confirmations or wrapper policies before allowing an agent to invoke these scripts automatically.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/settle.sh:18
Finding: Unsafe JSON Construction Allows Settlement Request Manipulation
Content: View full analysis
Vulnerability Details

File Location: scripts/settle.sh:18-21
Vulnerability Type: Improper JSON escaping and structured-data injection
Risk Level: Medium

Vulnerable Code

bash
curl -s -X POST "$API_URL/settle" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"with\": \"$WITH_AGENT\"}" | jq .

Technical Analysis

The script interpolates the user-controlled WITH_AGENT value directly into a JSON string. Although shell quoting prevents ordinary shell command injection, it does not escape JSON metacharacters.

An input containing quotation marks, backslashes, or additional JSON syntax can terminate the intended string and change the structure of the authenticated request. For example, a crafted value could create duplicate properties, inject additional properties, or make the body malformed. The exact result of duplicate-property injection depends on how the remote API parses JSON and validates settlement requests.

Other project scripts use jq -n --arg to construct JSON safely, but this protection is absent from the settlement script.

Attack Path

An attacker supplies or convinces an operator or agent to use a crafted MoltCredit agent identifier.

The identifier is passed as the first argument to settle.sh.

The script inserts the value directly into the JSON request body without escaping it.

The script attaches the victim's MOLTCREDIT_API_KEY bearer token.

The manipulated request is submitted to the /settle endpoint.

If the server accepts the injected structure or resolves duplicate fields unsafely, settlement generation may be performed with attacker-controlled parameters.

Impact Assessment

Exploitation occurs with the privileges associated with the victim's MoltCredit API key. A successful attack could manipulate the parameters of an authenticated settlement-generation request or cause repeated malf ...[truncated 238 chars]
Remediation: View remediation
Remediation Suggestions

Construct the body using jq so that the identifier is encoded as a JSON string rather than interpreted as JSON syntax:

bash
PAYLOAD=$(jq -n \ --arg with "$WITH_AGENT" \ '{with: $with}') curl --fail-with-body -sS -X POST "$API_URL/settle" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" | jq .

In addition:

Validate agent identifiers against the documented server-side format before sending the request.

Reject control characters, unexpected delimiters, and identifiers exceeding a reasonable length.

Require the server to reject unknown or duplicate JSON properties.

Validate settlement parameters again on the server and require explicit confirmation before any irreversible payment action.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/balance.sh:13
Finding: Unencoded Agent Identifier Can Alter Authenticated Balance Request Paths
Content: View full analysis
Vulnerability Details

File Location: scripts/balance.sh:13-16
Vulnerability Type: Improper URL path construction
Risk Level: Low

Vulnerable Code

bash
if [ -n "$AGENT" ]; then # Balance with specific agent curl -s "$API_URL/balance/$AGENT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq .

Technical Analysis

The user-controlled AGENT value is concatenated directly into the URL path without validation or percent-encoding. Shell metacharacters are not executed because the URL is quoted, but URL-significant characters such as /, ?, #, and path traversal segments can change how the URL is interpreted.

The API origin is fixed, so this issue does not by itself allow the bearer token to be sent to an arbitrary external host. It can, however, cause the authenticated request to target an unintended path or query on the same MoltCredit origin, depending on URL normalization and server routing behavior.

Attack Path

An attacker provides a crafted value presented as an agent handle.

An operator or automated agent passes that value to balance.sh.

The script appends it directly to $API_URL/balance/.

URL delimiters or path components alter the final request target.

Curl submits the altered request with the victim's MoltCredit bearer token.

If the same-origin API exposes a compatible route and lacks adequate authorization checks, the request may invoke behavior other than the intended per-agent balance lookup.

Impact Assessment

The immediate scope is limited to authenticated requests on the fixed MoltCredit HTTPS origin. Exploitation could retrieve unexpected same-origin data, reach an unintended route, or produce incorrect balance queries. It does not provide local code execution, operating-system privileges, or demonstrated cross-origin credential disclosure.
Remediation: View remediation
Remediation Suggestions

Enforce the documented agent-handle syntax before constructing the URL. For example, if handles permit only letters, numbers, underscores, and hyphens:

bash
if [[ ! "$AGENT" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Error: invalid agent handle" >&2 exit 1 fi

Percent-encode path segments rather than concatenating raw values.

Use an API design that accepts the identifier as an encoded query parameter or request body where practical.

Configure the server to reject unexpected path structures and independently enforce authorization on every route.

Use curl --fail-with-body -sS so HTTP and transport failures are not silently treated as valid JSON responses.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/history.sh:4
Finding: Unvalidated History Limit Permits Query-Parameter Injection
Content: View full analysis
Vulnerability Details

File Location: scripts/history.sh:4-14
Vulnerability Type: Improper URL query construction
Risk Level: Low

Vulnerable Code

bash
LIMIT="${1:-20}" if [ -z "$MOLTCREDIT_API_KEY" ]; then echo "Error: MOLTCREDIT_API_KEY not set" exit 1 fi API_URL="https://moltcredit-737941094496.europe-west1.run.app" curl -s "$API_URL/history?limit=$LIMIT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq .

Technical Analysis

LIMIT is intended to be a numeric result limit, but the script neither verifies that it is an integer nor URL-encodes it. Because it is directly appended to the query string, an input containing URL query delimiters can introduce additional parameters or alter the interpretation of the intended limit value.

Quoting the URL prevents shell command injection, and the fixed API origin prevents direct cross-origin token disclosure. The issue is confined to manipulation of an authenticated history request sent to the declared MoltCredit service.

Attack Path

An attacker influences the argument passed to history.sh.

The supplied value contains a query delimiter followed by an additional parameter.

The script concatenates the value into the URL without validation or encoding.

Curl sends the resulting query to /history with the victim's bearer token.

If the API recognizes the injected parameter, the response scope, filtering, pagination, or other supported behavior may differ from the operator's intent.

Impact Assessment

Exploitation may alter the scope or behavior of an authenticated transaction-history query, potentially returning more data than intended if the server supports relevant parameters and authorization permits it. The issue does not grant local privileges, execute commands, or redirect the credential to a different host based on the reviewed code.
Remediation: View remediation
Remediation Suggestions

Validate the argument as a bounded positive integer and use curl's query-encoding support:

bash
LIMIT="${1:-20}" if [[ ! "$LIMIT" =~ ^[0-9]+$ ]] || (( LIMIT < 1 || LIMIT > 100 )); then echo "Error: limit must be an integer from 1 to 100" >&2 exit 1 fi curl --fail-with-body -sS --get "$API_URL/history" \ --data-urlencode "limit=$LIMIT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq .

The server should also parse limit strictly, impose its own maximum page size, reject duplicate or unsupported parameters where appropriate, and enforce authorization independently of client validation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
# MoltCredit Skill Trust-based credit system for AI agents. Extend credit lines, track balances, settle via X402 protocol.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The skill instructs users to send registration data to an external service, which is an external transmission of agent-identifying information. While expected for a networked service, this still creates privacy and supply-chain risk because data is sent to a third-party endpoint and may establish credentials that are only shown once.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
Or via curl:

bash
curl -X POST https://moltcredit-737941094496.europe-west1.run.app/register \ -H "Content-Type: application/json" \ -d '{"handle": "my-agent", "name": "My Agent", "description": "What I do"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill enables recording debts and settling balances with stablecoins but provides no warning about financial risk, authorization requirements, or the potentially irreversible nature of settlement actions. In an agent context, this can lead to unintended monetary commitments or payments if an operator or downstream agent invokes settlement without explicit confirmation and policy checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This shell script performs network requests to an external API and transmits a bearer token from an environment variable, but it provides no confirmation prompt or user-facing notice before doing so. Although the script comment mentions checking balances, the actual remote transmission of credentials and account-query data is not explicitly disclosed to the user at runtime.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/extend-credit.sh (reported line 27)May include surrounding context.
sh
--arg currency "$CURRENCY" \ '{to: $to, limit: $limit, currency: $currency}') curl -s -X POST "$API_URL/credit/extend" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" | jq .

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script performs a state-changing financial action by sending an authenticated request to extend credit, but it does so immediately with no user confirmation, review step, or safety interlock. In an agent-skill context, this increases the chance of accidental or unintended credit issuance if the script is invoked with attacker-influenced arguments or through automation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/register.sh (reported line 21)May include surrounding context.
sh
--arg desc "$DESCRIPTION" \ '{handle: $handle, name: $name, description: $desc}') RESPONSE=$(curl -s -X POST "$API_URL/register" \ -H "Content-Type: application/json" \ -d "$PAYLOAD")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script prints the newly issued API key directly to stdout, which can expose the secret in terminal scrollback, CI/CD logs, session recordings, shared shells, or remote support sessions. Although the script warns to save the key, it does not warn about output exposure or provide a safer handling path, so the credential may be unintentionally disclosed immediately after creation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This script transmits data to an external endpoint and includes a bearer token from MOLTCREDIT_API_KEY in the Authorization header. While external communication is expected for a settlement workflow, the combination of authenticated network transmission and a state-changing /settle endpoint creates real risk if the script is invoked unexpectedly, pointed at an untrusted service in the future, or used in an automated context without adequate disclosure and safeguards.
Content: Scanner excerpt · scripts/settle.sh (reported line 18)May include surrounding context.
sh
API_URL="https://moltcredit-737941094496.europe-west1.run.app" curl -s -X POST "$API_URL/settle" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"with\": \"$WITH_AGENT\"}" | jq .

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script performs an authenticated external settlement action immediately when invoked, without any confirmation, dry-run mode, or warning that it will contact a remote service using the caller's API key. In an agent skill context, this is dangerous because a higher-level tool or user may trigger financial or state-changing operations unintentionally, especially since the action is silent (curl -s) and directly uses privileged credentials from the environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/transact.sh (reported line 34)May include surrounding context.
sh
--arg currency "$CURRENCY" \ '{with: $with, amount: $amount, description: $desc, currency: $currency}') curl -s -X POST "$API_URL/transact" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" | jq .

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script sends transaction details and an authorization token to a remote API via curl, but there is no confirmation prompt or user-facing notice at execution time that data will be transmitted off-host. While the file comment says it records a transaction, the actual network transmission and included fields are not explicitly disclosed to the user in runtime output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Self-Modification

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

Static analysis