MoltyRoyale

• Outcome: Review
• Latest audit: May 28, 2026 · 2:50 PM UTC
• Version: 1.4.2

Overview

This skill is a real Molty Royale game-agent guide, but it also gives the agent broad wallet, private-key, self-update, token deployment, trading, and payment authority that users should review before installing.

Install only if you intentionally want a Molty Royale agent that can participate in crypto-backed paid rooms and related token workflows. Do not give it production private keys or funded wallets unless you have a secure signer setup, clear spend limits, and manual confirmation for each transaction. Review the self-update behavior, local credential storage, token deployer, x402 purchase flow, and owner-key advanced mode before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (50)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file declares and documents a token-trading skill that is unrelated to the parent molty-royale skill's stated purpose of game-agent onboarding and gameplay. This kind of capability mismatch is dangerous because it can smuggle fund-moving blockchain actions into an unrelated agent package, increasing the chance that an operator invokes it under false assumptions and authorizes unintended trades.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill contains operational instructions for token approvals and live buy/sell swaps, which can directly spend user funds and grant token spending rights to a router contract. In the context of a game-agent skill, these capabilities are unjustified and materially increase the risk of covert financial abuse, especially because approval flows can enable subsequent token transfers.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file explicitly states free rooms are suspended and to use paid rooms only, yet it still provides operational instructions for joining and continuously running free rooms. In an agent skill, this contradiction can cause the agent to invoke deprecated or unavailable behavior, leading to policy bypass, failed automation loops, or unintended participation paths that conflict with current service constraints.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This skill is embedded under a Molty Royale game-agent context but actually advertises Cross Forge token deployment and liquidity operations. That mismatch is dangerous because it can cause an agent or user to invoke blockchain-asset creation functionality under a benign-looking game skill, enabling deceptive execution of unrelated and potentially costly actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The embedded code performs blockchain token deployment, temporary wallet creation, and liquidity-pool transaction construction, none of which are justified by the surrounding Molty Royale agent context. In this context, the hidden financial and on-chain capabilities materially increase the risk of unauthorized asset operations, user confusion, and irreversible blockchain transactions.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The heartbeat instructs the agent to automatically fetch remote `skill.md` and `heartbeat.md` files and overwrite local copies based on a server-provided version field. This creates a remote code/instruction supply-chain path: anyone who can influence the remote content or version signal can silently change future agent behavior on disk without user review.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The file gives contradictory instructions about which block explorer is official and which one must not be used. Later sections reverse the guidance again, which can misdirect users to the wrong blockchain explorer when verifying transactions, balances, or contract activity. In a wallet- and rewards-oriented skill, inconsistent verification guidance undermines trust and can cause operational mistakes or unsafe validation of on-chain actions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file adds token deployment, liquidity-pool creation, and on-chain registration workflows that are materially broader than the stated skill purpose of operating a Molty Royale game agent. This scope expansion can cause an agent invoked for gameplay management to perform high-risk financial or blockchain actions a user did not clearly intend, increasing the chance of unauthorized asset operations or social-engineered misuse.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Including token issuance and liquidity-pool setup introduces capabilities that can create irreversible on-chain transactions, expose users to financial loss, and expand the blast radius of prompt injection or mistaken invocation. In the context of a game-agent operations skill, these blockchain actions are unusually privileged and insufficiently justified, making accidental or manipulated execution more dangerous.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document gives conflicting instructions about paid-room CROSS rewards: the TL;DR says winners get an 80% prize-pool payout plus CROSS split 75% for agent-token purchase and 25% direct to the winner, while later sections state the Moltz prize pool is 0 and 100% of CROSS is used for agent-token purchase with no direct payout. In an economy/rewards guide, this inconsistency can cause agents or operators to make incorrect participation, wallet-registration, and reward-readiness decisions, potentially leading to lost rewards or financially harmful actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The document explicitly instructs the agent to store and retain a generated Owner EOA private key in local agent-side storage. That expands the skill from gameplay automation into custody of highly sensitive financial credentials, creating a key-compromise and unauthorized-signing risk if the agent, host, logs, or storage layer is exposed. In the context of a game agent, this is more dangerous because owner-wallet control is not necessary for routine gameplay and materially increases the blast radius beyond the stated skill purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The guidance says the skill may continue owner-side signing and wallet-management actions on the user's behalf. This grants the agent an unjustified and high-risk authority boundary: the ability to act as the owner rather than merely operate the game agent. In this skill context, that is especially dangerous because compromise or misuse could affect wallet access, paid-room funds, and account control rather than just gameplay state.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The guidance expands the agent from gameplay/onboarding into custody of owner credentials by generating, storing, and later disclosing a private key. That is a materially different and highly sensitive capability: once an agent can hold an owner wallet key, it can sign transactions and act as the owner, creating theft, impersonation, and irreversible blockchain-loss risk.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Authorizing the agent to keep a stored copy of an owner wallet private key and use it for owner-side signing gives the agent full ongoing control over the wallet. In an EVM context, this means any compromise, misuse, prompt-injection path, or logging leak could let an attacker drain funds, alter approvals, or take privileged actions as the owner.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This section expands the skill from operating a game agent into autonomous external-asset acquisition, token swapping, and wallet-directed fund flows. That materially increases financial risk because an agent following these instructions could spend USDC, acquire CROSS, and trade on a DEX without a strong, explicit per-transaction consent boundary, exposing users to irreversible loss, price slippage, routing mistakes, or abuse if the skill is invoked unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The document explicitly allows requesting, handling, and storing Owner private keys in an 'advanced opt-in' mode. Private-key custody is extremely sensitive and far broader than necessary for normal gameplay operations; if an agent, log, memory store, or integration is compromised, the owner's wallet and associated assets could be fully drained.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill embeds examples that require direct access to a raw EVM private key via environment variables to authorize payments. In isolation this can be normal for blockchain tooling, but in this repository context the parent skill is for a Molty Royale game agent, so introducing key-handling and token-purchase capability is out of scope and materially increases the chance an agent is induced to access sensitive wallet credentials and spend funds.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file's full behavior is an x402 token pricing and purchase workflow, which is unrelated to the declared Molty Royale agent purpose. This kind of capability mismatch is dangerous because it can smuggle unexpected financial operations into an agent context where users and orchestrators would not anticipate token purchases, payment signing, or wallet interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs the agent to execute irreversible swap transactions but does not prominently warn that these actions can permanently spend funds, fail under adverse pricing, or send assets to the wrong recipient. This omission can cause unsafe operator behavior and is more dangerous here because the surrounding skill context disguises the presence of financial actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The examples show passing a raw private key directly on the command line without a strong warning about credential exposure through shell history, process lists, logs, and copied documentation. This can lead to immediate wallet compromise and theft of all controlled assets if users follow the example literally.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The document instructs the agent to persist strategy, game history, observed opponents, and free-form notes to a local JSON file and to reread it on every heartbeat, but it does not give a clear privacy or security warning about continuous disk persistence. This can expose potentially sensitive operational data to other local users, backups, logs, or later unintended consumers, especially because the file lives in a predictable path under the user's home directory.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The fallback section says free play is always the fallback when paid prerequisites are incomplete, which directly broadens when free-room behavior may be triggered despite the document being marked suspended. This kind of ambiguous routing logic is dangerous in an autonomous agent because it can override safer gating, causing repeated attempts against disabled endpoints or unauthorized mode switching.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill instructs the agent to generate, save, and handle private keys and API credentials without an explicit security warning, consent boundary, or storage protection requirements. This is dangerous because compromise of the stored Agent EOA private key or API key would allow account takeover, unauthorized signing, and misuse of game funds or rewards.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill says to generate a new Owner EOA and store its private key automatically if the user lacks one, while only disclosing it on request. That creates an implicit custodial wallet workflow without clear consent, which can lead to silent possession of a user's controlling private key and severe loss if mishandled or exfiltrated.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger description uses broad phrases such as generic token-launch wording and catch-all language, making accidental or overly permissive invocation likely. For a skill capable of writing files, installing dependencies, and initiating token deployment, broad matching significantly increases the chance that unrelated user requests trigger sensitive behavior.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/agent-token.md:52

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/free-games.md:36

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/identity.md:72

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/matchmaking.md:35

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/paid-games.md:250

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/setup.md:84