MoltCredit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:37 PM UTC
• Version: 1.0.0

Overview

MoltCredit is a disclosed networked credit and settlement tool, but it can make financial state changes with an API key without confirmation or strong input safeguards.

Install only if you trust the MoltCredit service and are comfortable giving scripts access to a MOLTCREDIT_API_KEY. Treat credit extension, transaction recording, and settlement as financial actions: review recipients, amounts, and currencies manually, avoid attacker-supplied agent names or limits, and consider adding confirmations or wrapper policies before allowing an agent to invoke these scripts automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/settle.sh:18
• Finding: Unsafe JSON Construction Allows Settlement Request Manipulation## Vulnerability Details **File Location**: `scripts/settle.sh:18-21` **Vulnerability Type**: Improper JSON escaping and structured-data injection **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST "$API_URL/settle" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"with\": \"$WITH_AGENT\"}" | jq . ``` ### Technical Analysis The script interpolates the user-controlled `WITH_AGENT` value directly into a JSON string. Although shell quoting prevents ordinary shell command injection, it does not escape JSON metacharacters. An input containing quotation marks, backslashes, or additional JSON syntax can terminate the intended string and change the structure of the authenticated request. For example, a crafted value could create duplicate properties, inject additional properties, or make the body malformed. The exact result of duplicate-property injection depends on how the remote API parses JSON and validates settlement requests. Other project scripts use `jq -n --arg` to construct JSON safely, but this protection is absent from the settlement script. ### Attack Path 1. An attacker supplies or convinces an operator or agent to use a crafted MoltCredit agent identifier. 2. The identifier is passed as the first argument to `settle.sh`. 3. The script inserts the value directly into the JSON request body without escaping it. 4. The script attaches the victim's `MOLTCREDIT_API_KEY` bearer token. 5. The manipulated request is submitted to the `/settle` endpoint. 6. If the server accepts the injected structure or resolves duplicate fields unsafely, settlement generation may be performed with attacker-controlled parameters. ### Impact Assessment Exploitation occurs with the privileges associated with the victim's MoltCredit API key. A successful attack could manipulate the parameters of an authenticated settlement-generation request or cause repeated malf ...[truncated 238 chars]
• Remediation: ## Remediation Suggestions Construct the body using `jq` so that the identifier is encoded as a JSON string rather than interpreted as JSON syntax: ```bash PAYLOAD=$(jq -n \ --arg with "$WITH_AGENT" \ '{with: $with}') curl --fail-with-body -sS -X POST "$API_URL/settle" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" | jq . ``` In addition: 1. Validate agent identifiers against the documented server-side format before sending the request. 2. Reject control characters, unexpected delimiters, and identifiers exceeding a reasonable length. 3. Require the server to reject unknown or duplicate JSON properties. 4. Validate settlement parameters again on the server and require explicit confirmation before any irreversible payment action.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/balance.sh:13
• Finding: Unencoded Agent Identifier Can Alter Authenticated Balance Request Paths## Vulnerability Details **File Location**: `scripts/balance.sh:13-16` **Vulnerability Type**: Improper URL path construction **Risk Level**: Low ### Vulnerable Code ```bash if [ -n "$AGENT" ]; then # Balance with specific agent curl -s "$API_URL/balance/$AGENT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq . ``` ### Technical Analysis The user-controlled `AGENT` value is concatenated directly into the URL path without validation or percent-encoding. Shell metacharacters are not executed because the URL is quoted, but URL-significant characters such as `/`, `?`, `#`, and path traversal segments can change how the URL is interpreted. The API origin is fixed, so this issue does not by itself allow the bearer token to be sent to an arbitrary external host. It can, however, cause the authenticated request to target an unintended path or query on the same MoltCredit origin, depending on URL normalization and server routing behavior. ### Attack Path 1. An attacker provides a crafted value presented as an agent handle. 2. An operator or automated agent passes that value to `balance.sh`. 3. The script appends it directly to `$API_URL/balance/`. 4. URL delimiters or path components alter the final request target. 5. Curl submits the altered request with the victim's MoltCredit bearer token. 6. If the same-origin API exposes a compatible route and lacks adequate authorization checks, the request may invoke behavior other than the intended per-agent balance lookup. ### Impact Assessment The immediate scope is limited to authenticated requests on the fixed MoltCredit HTTPS origin. Exploitation could retrieve unexpected same-origin data, reach an unintended route, or produce incorrect balance queries. It does not provide local code execution, operating-system privileges, or demonstrated cross-origin credential disclosure.
• Remediation: ## Remediation Suggestions 1. Enforce the documented agent-handle syntax before constructing the URL. For example, if handles permit only letters, numbers, underscores, and hyphens: ```bash if [[ ! "$AGENT" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "Error: invalid agent handle" >&2 exit 1 fi ``` 2. Percent-encode path segments rather than concatenating raw values. 3. Use an API design that accepts the identifier as an encoded query parameter or request body where practical. 4. Configure the server to reject unexpected path structures and independently enforce authorization on every route. 5. Use `curl --fail-with-body -sS` so HTTP and transport failures are not silently treated as valid JSON responses.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/history.sh:4
• Finding: Unvalidated History Limit Permits Query-Parameter Injection## Vulnerability Details **File Location**: `scripts/history.sh:4-14` **Vulnerability Type**: Improper URL query construction **Risk Level**: Low ### Vulnerable Code ```bash LIMIT="${1:-20}" if [ -z "$MOLTCREDIT_API_KEY" ]; then echo "Error: MOLTCREDIT_API_KEY not set" exit 1 fi API_URL="https://moltcredit-737941094496.europe-west1.run.app" curl -s "$API_URL/history?limit=$LIMIT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq . ``` ### Technical Analysis `LIMIT` is intended to be a numeric result limit, but the script neither verifies that it is an integer nor URL-encodes it. Because it is directly appended to the query string, an input containing URL query delimiters can introduce additional parameters or alter the interpretation of the intended `limit` value. Quoting the URL prevents shell command injection, and the fixed API origin prevents direct cross-origin token disclosure. The issue is confined to manipulation of an authenticated history request sent to the declared MoltCredit service. ### Attack Path 1. An attacker influences the argument passed to `history.sh`. 2. The supplied value contains a query delimiter followed by an additional parameter. 3. The script concatenates the value into the URL without validation or encoding. 4. Curl sends the resulting query to `/history` with the victim's bearer token. 5. If the API recognizes the injected parameter, the response scope, filtering, pagination, or other supported behavior may differ from the operator's intent. ### Impact Assessment Exploitation may alter the scope or behavior of an authenticated transaction-history query, potentially returning more data than intended if the server supports relevant parameters and authorization permits it. The issue does not grant local privileges, execute commands, or redirect the credential to a different host based on the reviewed code.
• Remediation: ## Remediation Suggestions Validate the argument as a bounded positive integer and use curl's query-encoding support: ```bash LIMIT="${1:-20}" if [[ ! "$LIMIT" =~ ^[0-9]+$ ]] || (( LIMIT < 1 || LIMIT > 100 )); then echo "Error: limit must be an integer from 1 to 100" >&2 exit 1 fi curl --fail-with-body -sS --get "$API_URL/history" \ --data-urlencode "limit=$LIMIT" \ -H "Authorization: Bearer $MOLTCREDIT_API_KEY" | jq . ``` The server should also parse `limit` strictly, impose its own maximum page size, reject duplicate or unsupported parameters where appropriate, and enforce authorization independently of client validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Self-Modification

High

• Category: Rogue Agent

Content

# MoltCredit Skill

Trust-based credit system for AI agents. Extend credit lines, track balances, settle via X402 protocol.

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via curl:
```bash
curl -X POST https://moltcredit-737941094496.europe-west1.run.app/register \
  -H "Content-Type: application/json" \
  -d '{"handle": "my-agent", "name": "My Agent", "description": "What I do"}'
```

• Confidence: 83% confidence
• Finding: The skill instructs users to send registration data to an external service, which is an external transmission of agent-identifying information. While expected for a networked service, this still creates privacy and supply-chain risk because data is sent to a third-party endpoint and may establish credentials that are only shown once.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill enables recording debts and settling balances with stablecoins but provides no warning about financial risk, authorization requirements, or the potentially irreversible nature of settlement actions. In an agent context, this can lead to unintended monetary commitments or payments if an operator or downstream agent invokes settlement without explicit confirmation and policy checks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This shell script performs network requests to an external API and transmits a bearer token from an environment variable, but it provides no confirmation prompt or user-facing notice before doing so. Although the script comment mentions checking balances, the actual remote transmission of credentials and account-query data is not explicitly disclosed to the user at runtime.

External Transmission

Medium

• Category: Data Exfiltration

Content

--arg currency "$CURRENCY" \
  '{to: $to, limit: $limit, currency: $currency}')

curl -s -X POST "$API_URL/credit/extend" \
  -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" | jq .

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script performs a state-changing financial action by sending an authenticated request to extend credit, but it does so immediately with no user confirmation, review step, or safety interlock. In an agent-skill context, this increases the chance of accidental or unintended credit issuance if the script is invoked with attacker-influenced arguments or through automation.

External Transmission

Medium

• Category: Data Exfiltration

Content

--arg desc "$DESCRIPTION" \
  '{handle: $handle, name: $name, description: $desc}')

RESPONSE=$(curl -s -X POST "$API_URL/register" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints the newly issued API key directly to stdout, which can expose the secret in terminal scrollback, CI/CD logs, session recordings, shared shells, or remote support sessions. Although the script warns to save the key, it does not warn about output exposure or provide a safer handling path, so the credential may be unintentionally disclosed immediately after creation.

External Transmission

Medium

• Category: Data Exfiltration

Content

API_URL="https://moltcredit-737941094496.europe-west1.run.app"

curl -s -X POST "$API_URL/settle" \
  -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"with\": \"$WITH_AGENT\"}" | jq .

• Confidence: 89% confidence
• Finding: This script transmits data to an external endpoint and includes a bearer token from `MOLTCREDIT_API_KEY` in the Authorization header. While external communication is expected for a settlement workflow, the combination of authenticated network transmission and a state-changing `/settle` endpoint creates real risk if the script is invoked unexpectedly, pointed at an untrusted service in the future, or used in an automated context without adequate disclosure and safeguards.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script performs an authenticated external settlement action immediately when invoked, without any confirmation, dry-run mode, or warning that it will contact a remote service using the caller's API key. In an agent skill context, this is dangerous because a higher-level tool or user may trigger financial or state-changing operations unintentionally, especially since the action is silent (`curl -s`) and directly uses privileged credentials from the environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

--arg currency "$CURRENCY" \
  '{with: $with, amount: $amount, description: $desc, currency: $currency}')

curl -s -X POST "$API_URL/transact" \
  -H "Authorization: Bearer $MOLTCREDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" | jq .

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sends transaction details and an authorization token to a remote API via curl, but there is no confirmation prompt or user-facing notice at execution time that data will be transmitted off-host. While the file comment says it records a transaction, the actual network transmission and included fields are not explicitly disclosed to the user in runtime output.

Static analysis

No suspicious patterns detected.