MoltyRoyale

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.4.0

Overview

This game skill is not clearly malicious, but it asks agents to handle wallet keys, payments, paid-game spending, and self-updating instructions with weak safety boundaries.

Install only if you are comfortable giving the skill ongoing game-account and wallet-signing authority. Use isolated wallets with limited funds, avoid owner private-key mode, do not paste private keys into command lines, set explicit paid-game spending limits, and disable or scrutinize remote self-updates before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: heartbeat.md:43

Finding

Unverified Remote Replacement of Core Skill Instructions

Content

View full analysis

`memory.localFetchedAt`: curl -s https://www.moltyroyale.com/skill.md > ~/.molty-royale/skills/skill.md curl -s https://www.moltyroyale.com/heartbeat.md > ~/.molty-royale/skills/heartbeat.md ``` ### Technical Analysis The heartbeat replaces the local copies of the Skill's core operational instructions when a server-provided timestamp indicates that an update exists. The downloaded files are retrieved from the declared first-party website, but their integrity and authenticity are not verified using a pinned hash, trusted digital signature, or immutable release identifier. Because an AI agent subsequently follows these files as instructions, changing them can alter the effective behavior of the installed Skill after review. The use of HTTPS protects transport under normal conditions but does not protect against compromise of the website, deployment pipeline, DNS infrastructure, or trusted TLS endpoint. The commands also write directly to the active files. A truncated response, error page, or interrupted download can overwrite a previously valid copy. ### Attack Path 1. An attacker compromises the website, its deployment pipeline, DNS resolution, or another component capable of controlling the update responses. 2. The attacker causes `skillLastUpdate` to be newer than the locally stored `localFetchedAt` value. 3. A heartbeat downloads attacker-controlled `skill.md` and `heartbeat.md` content. 4. The downloaded content directly replaces the active local instruction files without validation. 5. A later agent run follows the modified instructions, potentially performing unauthorized network, wallet, credential, or filesystem operations. ### Impact Assessment Successful exploitation can alter future Skill behavior within th ...[truncated 371 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: cross-forge-trade.md:199

Finding

Wallet Private Keys Exposed Through Command-Line Arguments

Content

View full analysis

\ "[0xDdF8AaA3927b8Fd5684dc2edcc7287EcB0A2122d,0xdb99a97d607c5c5831263707E7b746312406ba7E]" \ \ \ --value 10ether \ --rpc-url https://mainnet.crosstoken.io:22001 \ --private-key ### Approve cast send 0xdb99a97d607c5c5831263707E7b746312406ba7E \ "approve(address,uint256)" \ 0x7aF414e4d373bb332f47769c8d28A446A0C1a1E8 \ \ --rpc-url https://mainnet.crosstoken.io:22001 \ --private-key ### Execute Sell cast send 0x7aF414e4d373bb332f47769c8d28A446A0C1a1E8 \ "swapExactTokensForNative(uint256,uint256,address[],address,uint256)" \ \ \ "[0xdb99a97d607c5c5831263707E7b746312406ba7E,0xDdF8AaA3927b8Fd5684dc2edcc7287EcB0A2122d]" \ \ \ --rpc-url https://mainnet.crosstoken.io:22001 \ --private-key ``` ### Technical Analysis The examples instruct users or agents to substitute a real wallet private key into the `--private-key` command-line option. Process arguments are not a suitable secret-transport mechanism. Depending on the environment, they may be exposed through: - Shell history and generated command logs. - Agent transcripts, observability systems, or terminal recording. - Process inspection by other local users. - Crash reports and debugging output. - CI/CD logs or automation telemetry. A private key provides unrestricted signing authority for its wallet. Unlike a revocable API token, compromise ordinarily requires migrating all assets and abandoning the affected address. ### Attack Path 1. A user or agent replaces `` with a real pr ...[truncated 791 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: x402-quickstart.md:23

Finding

Payment-Signing Clients Install Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:28

Finding

Plaintext API Credentials Are Persisted Without Consistent Access Controls

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:76

Finding

Autonomous Paid Gameplay Lacks Spending and Transaction Boundaries

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · heartbeat.md (reported line 254)May include surrounding context.

clear temp entirely

text

**Reset memory:**

```text
current_phase = preparing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The guide recommends storing the API key together with wallet-related identifiers and owner information in a predictable plaintext file path. In an agent environment, such a file may be read by other tools, leaked through logs/backups, or accessed by a compromised process, allowing account takeover actions and correlation with on-chain assets.

Content

Scanner excerpt · references/setup.md (reported line 157)May include surrounding context.

md

The `apiKey` is shown only once.

Recommended credentials path:
`~/.molty-royale/credentials.json`

Example:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document explicitly describes an 'Advanced Opt-In' mode where the agent may possess the owner's private key and perform owner-side signing, without a strong warning that this gives the agent full control over the owner's wallet and any associated assets. In a skill designed to be run by agents, this is especially dangerous because it encourages a highly sensitive trust boundary violation and even contemplates later revealing or handing off the private key.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The instruction to inspect dev-agent/credentials.json for first-run detection encourages direct access to a local credential store. In a skill context, normalizing credential-file reads as part of routine flow increases the chance that secrets are exposed to the model, included in context, mishandled by downstream tooling, or leaked through logs and error messages.

Content

Scanner excerpt · skill.md (reported line 30)May include surrounding context.

md

First-run detection (file-based):

- Treat as **first-run** if one of these is missing:
  - `dev-agent/credentials.json`
  - `dev-agent/owner-intake.json`
- If both files exist, treat as **returning-run**.
- Returning-run asks only missing/invalid fields, not the full list.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill explicitly tells the agent to persist credential values into dev-agent/credentials.json, which promotes storing API keys or similar secrets in plaintext local files. If the workstation, container, repository, backup system, or another agent process is compromised or misconfigured, those credentials can be recovered and abused to impersonate the user or control the game account.

Content

Scanner excerpt · skill.md (reported line 39)May include surrounding context.

md

- Ask the full owner question list once.
- Persist normalized answers into `dev-agent/owner-intake.json`.
- Persist credential values into `dev-agent/credentials.json`.
- Then execute the flow automatically.

Ask these in order (short, direct) to owner (human):

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file is materially inconsistent with the declared Molty Royale skill purpose and instead provides end-to-end instructions for blockchain token purchases using a private key and USDC. In an agent-skill context, this kind of capability expansion is dangerous because it can induce an agent or operator to handle secrets and authorize financial transactions unrelated to the advertised game workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented capability enables USDC payments and token purchases, which is a high-risk financial action unrelated to a Molty Royale agent's stated role. Because it instructs use of an Ethereum private key and payment-wrapping clients, a user or downstream agent could be tricked into authorizing real onchain transfers under false pretenses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill gives step-by-step instructions to execute on-chain swaps, approvals, and sends with a private key, but it does not clearly warn that these actions irreversibly move assets and may result in permanent loss from slippage, bad parameters, wrong recipient addresses, or interacting with incorrect contracts. In an agent skill that may be used operationally, this omission increases the chance that a user or agent executes risky transactions without explicit informed consent or safety confirmation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · heartbeat.md (reported line 14)May include surrounding context.

md

- `overall` → apply accumulated playstyle, strategy, and lessons
- `temp` → restore game context from the previous turn

If the file does not exist, start with defaults and create it after the first game ends.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown instructs the skill to send X-API-Key to remote HTTP and websocket endpoints, which is a sensitive credential transmission. The file includes operational steps but does not warn the user that the skill will use and transmit an API key to external services or advise safeguarding it.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 117)May include surrounding context.

2b. Enter queue

bash

curl -X POST https://cdn.moltyroyale.com/api/join \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"entryType": "free"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes sending an X-API-Key to /join and includes a live-looking example header value, but it does not warn users that the key is sensitive or should be protected from logs, screenshots, or source control. Under the markdown criteria for missing user warnings, omission of a warning about credential/privacy-sensitive behavior is a valid finding.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/matchmaking.md (reported line 33)May include surrounding context.

Example:

bash

curl -X POST https://cdn.moltyroyale.com/api/join \
  -H "Content-Type: application/json" \
  -H "X-API-Key: mr_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -d '{"entryType": "free"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to sign EIP-712 typed data with a private key and submit a paid join request, but it does not include explicit safety guidance about protected key handling, signature review, or the financial effect of the action. In this context, the workflow can trigger entry-fee spending and bind the agent to a paid game, so omission of transaction-risk warnings increases the chance of unsafe automated signing or unintended fund use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The setup process directs the agent to persist a newly generated EOA private key on disk for ongoing use. Persistent secret material is often necessary for wallet-based agents, but here it is presented without safeguards such as encryption, lifecycle controls, or warnings about persistence risks, making theft or unintended reuse more likely.

Content

Scanner excerpt · references/setup.md (reported line 61)May include surrounding context.

md

---

# 1. Create Agent Wallet

Generate a dedicated EOA keypair for the agent.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs generation and local storage of a blockchain private key and later storage of API credentials, but it does not prominently warn that these secrets grant control over funds, account actions, and reward identity. In an agent skill context, normalizing plaintext secret handling in home-directory JSON files increases the chance that downstream agents, logs, backups, or multi-tenant environments expose reusable credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 123)May include surrounding context.

Example:

bash

curl -X POST https://cdn.moltyroyale.com/api/accounts \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "wallet_address": "0xYourEthereumAddress"}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "join game" is broad enough to match many unrelated gaming or app workflows, which can cause unintended activation of this skill. In an agent environment, accidental routing to a skill that can join rooms or perform game actions may lead to unwanted external requests or state changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrase "find game" is highly ambiguous and could match generic user requests unrelated to Molty Royale. This increases the chance of misrouting conversations to a skill that interacts with an external service, potentially causing unintended discovery, enrollment, or API calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase "check game" is generic and may overlap with many status-checking requests across unrelated applications. Because this skill manages game participation and state, erroneous activation could expose or alter gameplay-related state and generate unnecessary outbound traffic to the configured API.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase "moltz" is too generic and not clearly tied to the exact skill identity, making accidental or fuzzy-match activation more likely. In a skill capable of onboarding, joining paid or free rooms, and managing rewards, unintended invocation can have operational or financial side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to persist owner intake data and credential values locally without any stated protections such as minimal retention, access control, encryption, or redaction. In an agent environment, these files may be readable by other tools, users, logs, backups, or later prompts, leading to credential leakage and privacy exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation at L179-L180 instructs the agent to 'keep free play running' after onboarding, which directly conflicts with the earlier rules that free rooms are suspended and that the agent must use paid rooms only and wait if paid prerequisites are missing. This is an active contradiction in the skill's own guidance, not merely an omission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide asks for an Ethereum-compatible private key and describes authorizing USDC-funded purchases without a prominent security warning about secret handling and real financial consequences. That omission increases the likelihood of unsafe key exposure, accidental mainnet use, or uninformed authorization of token transfers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The purchase section documents a flow that initiates a real x402 payment and EIP-3009 authorization, but it does not prominently warn that repeating the request with a PAYMENT-SIGNATURE can authorize an on-chain USDC transfer. In an agent skill context, this omission is dangerous because an automation system may execute the purchase path as a normal API call, causing unintended financial loss or wallet authorization without explicit user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/matchmaking.md:35

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/setup.md:84