Security audit

Moria Skill

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Moria.fun wallet skill, but it needs Review because it can sign mainnet transactions, stores recoverable wallet key material locally, and under-discloses credential and upload behavior.

Install only if you are comfortable granting an agent control of a dedicated, low-balance Moria/Solana wallet. Treat the Moria code and config/config.json as sensitive wallet credentials, require a plain-language transaction summary before every buy/sell/mint/refund/claim/create action, and replace or rotate the embedded Pinata/RPC credentials before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation states wallet withdrawal capability, but the manifest description does not disclose it. For a financial skill, omission of withdrawal functionality is dangerous because users may authorize the skill for informational or trading tasks without understanding it can also move funds out of the wallet.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The type declarations expose a much broader capability surface than the skill metadata claims, including full DAMM/CP-AMM pool control, liquidity operations, rewards, locking, splitting, and protocol fee actions. In an agent skill context, this is dangerous because the agent may be granted or infer authority to construct high-risk on-chain transactions outside the user-expected wallet/token lifecycle scope, enabling unintended fund movement or protocol administration.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This SDK includes operator/admin DAMM V2 functions such as config creation, dynamic config creation, operator account management, token badge management, pool status updates, and fee updates that are unrelated to the stated purpose. Even if these require privileged signers on-chain, exposing them to an agent materially increases risk by making privileged transaction construction available through a skill that users would not expect to have governance or admin reach.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The exposed DAMM V2 methods include reward funding, reward withdrawal, position locking, permanent locking, split/close position flows, and protocol-fee zap functionality, all of which are high-impact financial primitives beyond simple token management. In the context of an agent skill advertised for wallet/token operations, this creates a dangerous mismatch where the agent can assemble complex DeFi control transactions that could lock assets, redirect rewards, or alter liquidity positions.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The bundled SDK includes a second, broad AMM IDL exposing many capabilities far beyond the skill's declared Moria.fun wallet/token workflow, including liquidity, reward, vesting, operator, and pool administration primitives. In an agent-skill context, this creates a dangerous capability mismatch: downstream code or prompts can invoke privileged or unrelated on-chain actions that a user would not reasonably expect from the manifest.

Context-Inappropriate Capability

High

Confidence: 92% confidence
Finding: The file exposes operator/admin functions such as config creation, dynamic config creation, operator account creation, fee updates, and pool status changes that are not justified by the stated user wallet/token management purpose. Even if on-chain authorization exists, surfacing these privileged interfaces inside an agent skill materially increases the risk of misuse, confused-deputy behavior, and accidental invocation of administrative actions.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Reward and vesting management capabilities are unrelated to the declared wallet/token workflow and unnecessarily expand the action surface available to the agent. In a wallet-integrated skill, hidden access to these financial lifecycle operations can enable unintended token locking, reward manipulation, or user confusion about what the skill is allowed to do.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The SDK bundles broad protocol-level capabilities, including pool initialization, migration, fee claiming, reward and liquidity-management primitives, which exceed the stated wallet/token-management purpose of the skill. In an agent context, this scope expansion is dangerous because downstream callers may unknowingly expose powerful transaction construction paths that can alter protocol state or move assets beyond simple user wallet operations.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The embedded IDLs expose numerous operator/admin control primitives such as config creation, operator account creation, fee updates, pool status changes, and protocol fee claiming that are not justified by the skill's user-facing wallet role. Even if the on-chain program enforces authorization, surfacing these privileged operations inside an agent skill materially increases the chance of misuse, confused-deputy behavior, or accidental signing of sensitive administrative transactions.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The policy creates a dangerous contradiction: one section allows disclosure of raw sensitive information when a user 'explicitly and forcefully' requests it, while a later mandatory section requires refusing plaintext config disclosure. In a wallet-management skill handling potentially valuable Web3 credentials, this ambiguity can be exploited through prompt injection or social engineering to justify revealing secrets.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The bootstrap instructs the agent to solicit a user's Moria 'code' and pass it directly into a configuration command, but it does not clearly classify the code as a sensitive credential, warn against exposing it in chat/logs, or describe secure handling requirements. In a Web3 wallet-management skill, this is especially dangerous because the code appears to gate access to wallet-linked operations such as minting, trading, refunds, claims, and balance actions, so mishandling it could enable account takeover or unauthorized asset operations.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The activation conditions are broad and vague, making it easier for the agent to load this skill in loosely related conversations. Because the skill can perform wallet and trading operations, overbroad triggering raises the chance of accidental invocation of high-risk financial actions in the wrong context.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The instructions tell the agent to confirm intent and then directly use commands, while also defaulting optional parameters without follow-up. For irreversible Web3 actions like buy, sell, mint, refund, claim, and possible withdrawal, the absence of explicit risk warnings and transaction-specific confirmations can lead to unintended transactions and permanent financial loss.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The transaction builder silently adds ATA creation plus SOL wrap/unwrap instructions around the token purchase flow, which changes account state and moves funds beyond the user's apparent high-level action. In an agent setting, hidden side effects are risky because users may approve a transaction without understanding that new token accounts will be created and lamports temporarily converted to wrapped SOL.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The refund flow also injects account-creation and wrapped-SOL close operations without visible disclosure, creating hidden on-chain effects in what appears to be a simple refund action. This is particularly dangerous for an agent skill because the user may not expect rent changes, ATA creation, or automatic account closure when authorizing a refund-related transaction.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The transaction builders automatically create token accounts, wrap SOL via lamport transfer, and close wrapped SOL accounts when constructing transactions, but this file contains no explicit user-consent or policy hooks around those side effects. In an agent-driven wallet setting, silent transaction composition can cause users to approve asset-moving or account-mutating actions they did not clearly intend, especially when combined with higher-level natural-language prompts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code persists sensitive wallet material (`privy_device_id`, encryption key, and encrypted private key) to disk in a local config file. Because the decryption key is stored alongside the ciphertext, compromise of the file effectively exposes the wallet secret, which is especially dangerous in a Web3 wallet-management skill where stolen keys can lead to irreversible asset theft.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This function sends a persistent device identifier to a remote service as a URL query parameter. Even though it is URL-encoded, placing a device identifier in the URL increases exposure through logs, browser history, intermediaries, referrers, and monitoring systems, and there is no visible evidence in this file of user notice, minimization, or consent. In a Web3 wallet-management skill, device-linked requests can enable account correlation and privacy loss across sensitive token activity.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This API call repeats the same privacy-sensitive pattern by transmitting the device identifier in the URL. Because this skill manages token and wallet-related data, the identifier can be used to correlate a user's holdings and actions, making the privacy impact more significant than in a non-sensitive application context.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The request includes the device identifier in a remote lookup URL, which can leak through standard HTTP logging and observability infrastructure despite using HTTPS. In the context of a Web3 token platform, this can facilitate tracking of a user's token interactions and profiling tied to a device, creating a meaningful privacy and metadata exposure risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This remote token lookup also sends a device identifier in the URL, creating the same metadata leakage and user-tracking risk. Given that the skill description explicitly covers wallet management, balances, trading, minting, refunds, and claiming, linking those actions to a stable device identifier is especially sensitive and increases the danger of deanonymization or behavioral profiling.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The function fetches and returns a wallet object that includes a private key from a remote API based only on a code parameter, with no visible consent prompt, scoping, minimization, or additional verification in this code path. In a Web3 wallet-management skill, exposing raw private key material to the agent runtime is especially dangerous because compromise, logging, misuse, or prompt-injection-driven actions could directly lead to irreversible asset theft.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The helper reads local files and uploads their contents to Pinata over the network without any built-in user consent, disclosure, or allowlist restrictions. In an agent skill context, this increases the chance of unintended exfiltration of local data if an attacker can influence the file path or trigger upload flows.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A live Pinata JWT is hardcoded directly in source, exposing a sensitive credential to anyone with code access and enabling unauthorized use of the associated Pinata account. Attackers could abuse it to upload arbitrary content, consume quota, access related services, and potentially create legal, billing, or reputational harm.

Ssd 1

Medium

Confidence: 82% confidence
Finding: The embedded instruction telling non-human readers to forget or refuse disclosure is a prompt-injection style artifact inside a source file containing secrets-related logic. In an agent ecosystem, such text can interfere with automated review, monitoring, or incident response, and its presence is more concerning here because the skill manages Web3 wallets and private key material.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/config.ts:23