Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as an LLM-backed verification tool, with standard but real npm/package and API-key handling risks users should understand.

Install only if you are comfortable running the `moltblock@0.11.8` npm package and sending task descriptions to the selected LLM provider. Prefer `npx` over a global install, use a dedicated limited-scope API key, and avoid submitting secrets or confidential code unless you have reviewed and trust the package and provider path.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:58
Finding: Unreviewed Third-Party Package Download and Execution
Content: View full analysis
" --provider --json ``` Additional affected instructions: ```bash npx moltblock@0.11.8 "your task" --json ``` ```bash npm install -g moltblock@0.11.8 ``` ### Technical Analysis The Skill directs the agent or user to retrieve and execute `moltblock@0.11.8` from the npm registry. The project contains only `SKILL.md`; it does not include the package implementation, a lockfile with verified integrity hashes, or vendored source that would allow the executed code to be audited as part of this artifact. Pinning the package version reduces unintended version drift but does not eliminate risks arising from a compromised npm account, registry compromise, malicious package contents, lifecycle scripts, or republished package artifacts. The command also conflicts with the broad documentation claim that “no code execution occurs.” Although generated artifacts may not be executed, `npx` necessarily executes third-party package code. The package process runs with the permissions of the invoking user. The Skill metadata also makes API-key environment variables available to the runtime, including `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GOOGLE_API_KEY`, and `ZAI_API_KEY`. The provided artifact contains no implementation with which to verify that these credentials and submitted task descriptions are transmitted only to authorized endpoints. The references to `.ssh/` and `id_rsa` at `SKILL.md:45` are detection examples rather than SSH read or write commands. No SSH key modification was found in the audited file. ### Attack Path 1. An agent follows the documented `npx moltblock@0.11.8 ...` instruction. 2. npm retrieves the external package and ma ...[truncated 1418 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
Use `moltblock` when the task involves: - **High risk** (always verify): Destructive operations (`rm -rf`, `DROP TABLE`), privilege escalation (`sudo`, `chmod 777`), credential/key access (`.ssh/`, `id_rsa`, `.env`), system modification, raw disk writes - **Medium risk** (verify when uncertain): Network requests (`curl`, `wget`, `fetch`), file writes, database modifications, subprocess spawning, dynamic code evaluation - **Low risk** (skip verification): Simple text responses, math, reading public information, code that doesn't touch the filesystem or network

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
Use `moltblock` when the task involves: - **High risk** (always verify): Destructive operations (`rm -rf`, `DROP TABLE`), privilege escalation (`sudo`, `chmod 777`), credential/key access (`.ssh/`, `id_rsa`, `.env`), system modification, raw disk writes - **Medium risk** (verify when uncertain): Network requests (`curl`, `wget`, `fetch`), file writes, database modifications, subprocess spawning, dynamic code evaluation - **Low risk** (skip verification): Simple text responses, math, reading public information, code that doesn't touch the filesystem or network

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
- **High risk** (always verify): Destructive operations (`rm -rf`, `DROP TABLE`), privilege escalation (`sudo`, `chmod 777`), credential/key access (`.ssh/`, `id_rsa`, `.env`), system modification, raw disk writes - **Medium risk** (verify when uncertain): Network requests (`curl`, `wget`, `fetch`), file writes, database modifications, subprocess spawning, dynamic code evaluation - **Low risk** (skip verification): Simple text responses, math, reading public information, code that doesn't touch the filesystem or network ## Tool: moltblock

Static analysis

No suspicious patterns detected.