Molt Pmxt

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:31 AM UTC
• Version: 1.1.0

Overview

This skill matches its prediction-market purpose, but it needs review because it can use private trading credentials to place real-money orders without an enforced confirmation gate.

Install only if you intentionally want an agent to access prediction-market accounts. For read-only use, do not configure private keys or trading API keys. If trading is needed, use low-balance or tightly scoped accounts, keep confirmation outside the agent, set exchange-side limits where possible, and treat all configured private keys as sensitive signing material.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill reads credential-bearing environment variables to initialize authenticated trading clients, but the manifest does not declare any environment or secret access capability. This creates a permission mismatch where a tool framed as low-cost market data access can silently gain access to trading credentials and act with more privilege than the declared permissions suggest.

Scope Creep

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the runtime to provide highly sensitive secrets, including wallet private keys and API signing keys, but does not declare or constrain secret access in permissions. This creates a dangerous mismatch where an agent may be granted broad credential access without explicit review, increasing the risk of credential misuse, unauthorized trading, or theft of funds if the skill or connected tooling is compromised.

Scope Creep

Medium

• Confidence: 90% confidence
• Finding: The lockfile shows the transitive dependency pmxt-core pulling in Express and related HTTP server components, which gives the skill the capability to start a local server even though the declared permissions only mention outbound access to specific market domains. In an agent setting, undeclared server capability expands the attack surface and can enable local callback endpoints, data exposure, or unintended inter-process access.

Scope Creep

Medium

• Confidence: 86% confidence
• Finding: The dependency set includes generic HTTP and WebSocket libraries such as axios and ws via pmxt-core and related packages, which technically permit connections to arbitrary endpoints beyond polymarket.com, kalshi.com, and limitless.exchange. In a constrained agent environment, this creates a mismatch between declared scope and actual capability, increasing the risk of exfiltration or policy bypass if the package is misused or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code initializes Polymarket, Kalshi, and Limitless clients with private keys and API keys even though the skill description emphasizes fact-checking and probability analysis. Because the same file also exposes an order-placement function, these secrets enable real-money trading, which materially exceeds a read-only analytical use case and increases the blast radius if the skill is invoked unexpectedly or misused.

Scope Creep

High

• Confidence: 95% confidence
• Finding: This file accesses multiple environment-based secrets without corresponding declared permissions, allowing hidden privileged behavior not visible in the manifest. In security terms, undeclared secret access undermines least privilege and informed consent, especially when those secrets are sufficient to authenticate to financial exchanges.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill normalizes use of private keys and API credentials for live trading without warning about secret-handling, privacy, or financial-risk implications. In this context, the danger is elevated because the secrets are not incidental—they directly authorize real-money trades and signing operations, so poor handling can lead to account compromise, fund loss, and sensitive credential exposure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The pmxt_order function directly places real-money orders using authenticated exchange clients with no confirmation, no warning, no policy gate, and no validation that the user explicitly intended a financial transaction. In the context of prediction markets, this can cause immediate monetary loss, unauthorized trades, and irreversible execution from a single tool call.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "type": "module",
  "dependencies": {
    "pmxtjs": "^2.0.7"
  },
  "devDependencies": {
    "@types/node": "^25.2.2",

• Confidence: 86% confidence
• Finding: The runtime dependency uses a caret range, which allows installation of newer semver-compatible releases than the one originally reviewed. This increases supply-chain risk because a compromised or malicious future release of pmxtjs could be pulled in automatically, and in this skill that dependency likely has access to live market data and possibly trading-related functionality.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@types/node": "^25.2.2",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3",
    "vitest": "^4.0.18"
  }
}

• Confidence: 91% confidence
• Finding: vitest is unpinned and also has a known critical advisory at the specified version, so allowing version drift compounds existing risk. Even as a dev dependency, a compromised or vulnerable test tool can affect CI, local developer environments, or any environment where tests or UI mode are run.

Known Vulnerable Dependency: vitest==4.0.18 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The package explicitly includes vitest 4.0.18, which is reported as affected by a critical issue allowing arbitrary file read and execution when the Vitest UI server is listening. Although this is a dev dependency, exploitation could compromise developer workstations or CI runners, exposing source, credentials, or build secrets; in a skill tied to prediction-market access, that could indirectly expose API keys or trading-related secrets.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.