T06 · System Persistence
Error
- Location
references/cron-definitions.md:8- Finding
Persistent Silent Cron Jobs Perform Autonomous Financial Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
MoltMarkets Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is clearly for MoltMarkets automation, but it sets up persistent, mostly silent agents that can spend funds, create markets, post public comments, and resolve outcomes with limited user control.
Review before installing. This skill can act on your MoltMarkets account repeatedly without per-action confirmation, including spending balance, creating markets, resolving outcomes, and posting comments. Use only with a dedicated low-balance account or scoped token if available, secure the credential file, disable or remove cron jobs when not actively supervising them, and avoid silent mode for state-changing actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
references/cron-definitions.md:57- Finding
Untrusted Market Comments and Titles Can Influence Privileged Agent Actions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:23- Finding
Bearer API Credential Is Stored Without Enforced Restrictive Permissions
- Content
View full analysis
~/.config/moltmarkets/credentials.json << 'EOF' { "api_key": "mm_your_api_key_here", "user_id": "your-user-uuid", "username": "your_username" } EOF ``` ```javascript const CREDS_PATH = path.join(process.env.HOME, '.config/moltmarkets/credentials.json'); // Check credentials if (!fs.existsSync(CREDS_PATH)) { console.error('✗ Missing credentials file: ~/.config/moltmarkets/credentials.json'); console.error(' Create it with: { "api_key": "mm_xxx", "user_id": "uuid", "username": "xxx" }'); process.exit(1); } const creds = JSON.parse(fs.readFileSync(CREDS_PATH, 'utf8')); console.log(`✓ Found credentials for user: ${creds.username}`); ``` ### Technical Analysis The documentation creates a plaintext bearer-token file using `mkdir` and shell redirection but does not set explicit permissions on either the directory or file. Effective permissions therefore depend on the current umask and pre-existing directory state. On systems with permissive settings, another local user or process may be able to read the token. The setup script validates only that the path exists; it does not verify file ownership, reject symbolic links, or detect group/world-readable permissions. Reading this specific credential is necessary for the declared authenticated trading functionality. The excessive risk arises from retaining a financially privileged bearer token without enforcing minimum filesystem protections. ### Attack Path 1. The user follows the documentation on a machine with a permissive umask or an insecure pre-existing configuration directory. 2. `crede ...[truncated 1013 chars]- Remediation
View remediation
"$HOME/.config/moltmarkets/credentials.json" <<'EOF' { "api_key": "mm_your_api_key_here", "user_id": "your-user-uuid", "username": "your_username" } EOF chmod 600 "$HOME/.config/moltmarkets/credentials.json" ``` 2. In `setup.js`, use `fs.lstatSync` to reject symbolic links. 3. Verify that the file is owned by the current effective user. 4. Check permission bits and reject or correct files readable or writable by group or other users. 5. Prefer an operating-system credential manager or secret service rather than a plaintext JSON file. 6. Use a dedicated, narrowly scoped API token and document immediate token revocation procedures. 7. Avoid retaining `user_id` and other fields if they are not required by the executable code. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/cron-definitions.md:223- Finding
Current CoinGecko Price Can Be Used as Historical Close Price During Market Resolution
- Content
View full analysis
= threshold → YES - "above/over/hit" + price < threshold → NO - "below/under" + price <= threshold → YES - "below/under" + price > threshold → NO **STEP 5: CALL RESOLVE ENDPOINT** curl -X POST "$API/markets/{market_id}/resolve" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"outcome": "YES", "resolution_note": "BTC was $74,832 at 19:15:59 UTC (Binance 1m kline)"}' ``` ### Technical Analysis The workflow states that it needs the historical price at `closes_at`, but its primary CoinGecko request uses `/simple/price`. That endpoint returns a current spot price and does not accept the market close timestamp shown in this workflow. The resolution cron runs every seven minutes, so the fetched current price may be several minutes later than the contractual close time. Volatile assets can cross a threshold during that interval. If the current CoinGec ...[truncated 1481 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/setup.js:34- Finding
Malformed HTTPS Hostname Prevents Reliable API Credential Validation
- Content
View full analysis
{ const options = { hostname: 'api.zcombinator.io/molt', path: '/me', method: 'GET', headers: { 'Authorization': `Bearer ${creds.api_key}` } }; ``` ### Technical Analysis Node.js HTTPS request options require `hostname` to contain only the network hostname. The value `api.zcombinator.io/molt` incorrectly includes a URL path component. According to the API reference in the project, the intended base URL is: ```text https://api.zcombinator.io/molt ``` Therefore, the request should use hostname `api.zcombinator.io` and path `/molt/me`. The current configuration is expected to fail hostname validation or DNS resolution instead of reaching the intended endpoint. Because `main()` waits for this validation before creating the memory files, the defect can prevent setup from completing even when the credential is valid. ### Attack Path 1. The user creates a valid credential file and runs `scripts/setup.js`. 2. `validateApiKey()` constructs an HTTPS request with a slash in the hostname. 3. The request fails before reaching the documented MoltMarkets endpoint. 4. The promise rejects and `main()` enters its error handler. 5. The process exits with status code `1`, leaving setup incomplete. This issue does not itself expose the credential to a different host; it primarily affects availability and validation reliability. ### Impact Assessment The direct impact is denial of setup functionality: - Valid credentials cannot be reliably validated. - Required state files may not be initialized. - Users may attempt insecure workarounds or disable validation. - Operational deployment becomes inconsistent. No privilege escalation or credential exfiltr ...[truncated 42 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises autonomous trading, market creation, and auto-resolution but omits clear user warnings that these actions can spend funds, create financial exposure, and act without per-trade review. In this context, lack of informed consent and guardrails is dangerous because cron-driven automation can repeatedly execute risky actions at scale.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Merely mentioning where to obtain an API key is not harmful by itself, but in context it is part of a workflow that immediately stores and uses powerful credentials for automated financial actions. That makes the credential acquisition guidance security-relevant because it normalizes handling sensitive tokens without accompanying safeguards.
- Content
md # Create config directory mkdir -p ~/.config/moltmarkets # Save your credentials (get API key from moltmarkets.com settings) cat > ~/.config/moltmarkets/credentials.json << 'EOF' { "api_key": "mm_your_api_key_here",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This finding points to direct handling of a credentials file containing an API key. Exposing or mishandling such credentials is dangerous because the same skill is designed to perform authenticated account actions, so compromise can quickly become unauthorized trading or market manipulation.
- Content
md mkdir -p ~/.config/moltmarkets # Save your credentials (get API key from moltmarkets.com settings) cat > ~/.config/moltmarkets/credentials.json << 'EOF' { "api_key": "mm_your_api_key_here", "user_id": "your-user-uuid",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 90% confidence
- Finding
The output rules attempt to suppress intermediate visibility and force silent execution semantics around the spawned task. That pattern reduces oversight and can help conceal unsafe actions, making it easier for prompt-level instructions to bypass user scrutiny during autonomous external operations.
- Content
md Use POST /markets/{id}/comments endpoint after placing a bet. **OUTPUT RULES:** - NO intermediate messages - NO spawn announcements — work SILENTLY - ONLY send ONE final report with: position taken (or why skipped), learning context applied, new balance
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs use of a local credentials file for automated resolution actions. Direct credential access in prompt instructions expands the blast radius of prompt injection or mis-scoped agent permissions, especially when combined with external POST requests that can alter financial market outcomes.
- Content
md kind: 'agentTurn', message: `MARKET AUTO-RESOLUTION — HISTORICAL PRICE LOGIC **CREDS:** ~/.config/moltmarkets/credentials.json **API:** https://api.zcombinator.io/molt **STEP 1: FIND MARKETS TO RESOLVE**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const https = require('https'); const MEMORY_DIR = path.join(process.cwd(), 'memory'); const CREDS_PATH = path.join(process.env.HOME, '.config/moltmarkets/credentials.json'); // Ensure memory directory exists if (!fs.existsSync(MEMORY_DIR)) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const https = require('https'); const MEMORY_DIR = path.join(process.cwd(), 'memory'); const CREDS_PATH = path.join(process.env.HOME, '.config/moltmarkets/credentials.json'); // Ensure memory directory exists if (!fs.existsSync(MEMORY_DIR)) {
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill describes capabilities that rely on environment/configured credentials and likely external actions, but it declares no explicit tool scope or permissions boundary. That makes invocation and review less safe because a caller cannot clearly see what resources the skill expects to access or mutate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description uses broad activation language such as using the skill whenever setting up, configuring, or replicating an agent architecture. Over-broad triggers increase the chance the skill is invoked in contexts the user did not intend, especially since it performs or enables high-impact trading automation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions tell users to store a live API key in a plaintext JSON file under ~/.config without warning about local compromise, accidental backup/sync leakage, or file permission hardening. Because the key appears to authorize trading and account actions, theft could lead directly to unauthorized market actions and financial loss.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill instructs the user to create persistent local configuration storage for sensitive account material. Persistent session/state storage increases the attack surface because secrets may remain available long after use, be copied into backups, or be accessed by other local processes.
- Content
1. Get MoltMarkets Credentials
bash # Create config directory mkdir -p ~/.config/moltmarkets # Save your credentials (get API key from moltmarkets.com settings)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance recommends a politically charged persona ('Nick Fuentes' energy) without user opt-in, increasing the risk of generating extremist, abusive, or reputationally harmful content. In a public trading/commenting agent, this can expose the user to moderation, account sanctions, or brand damage.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Body: {"outcome": "YES" | "NO"}
text Base URL: `https://api.zcombinator.io/molt` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Body: {"outcome": "YES" | "NO"}
text Base URL: `https://api.zcombinator.io/molt` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Body: {"outcome": "YES" | "NO"}
text Base URL: `https://api.zcombinator.io/molt` ## Authentication
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file documents creator and committee resolution actions that can immediately resolve a market, and line L149 notes that committee consensus causes immediate resolution. However, the documentation does not include a clear warning that these actions are consequential and may be irreversible or affect market outcomes and user positions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
CoinGecko (Primary — no geo-restrictions)
text GET https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum,solana&vs_currencies=usdResponse:
{ "bitcoin": { "usd": 75000 }, "ethereum": { "usd": 2500 }, "solana": { "usd": 100 } }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
CoinGecko (Primary — no geo-restrictions)
text GET https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum,solana&vs_currencies=usdResponse:
{ "bitcoin": { "usd": 75000 }, "ethereum": { "usd": 2500 }, "solana": { "usd": 100 } }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Binance Klines (Fallback — may be geo-blocked)
text GET https://api.binance.com/api/v3/klines?symbol=BTCUSDT&interval=1m&startTime={ms}&limit=1Response:
[[openTime, open, high, low, close, volume, ...]]
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Binance Klines (Fallback — may be geo-blocked)
text GET https://api.binance.com/api/v3/klines?symbol=BTCUSDT&interval=1m&startTime={ms}&limit=1Response:
[[openTime, open, high, low, close, volume, ...]]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trader cron explicitly instructs silent operation while updating local memory files and posting external market comments after trades. That removes user visibility and consent for state changes and outbound actions, which is risky in an autonomous trading agent because it can manipulate external systems and alter audit data without review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates a fixed 'degenerate trader' tone with edgy language for public comments and does not provide user opt-in or moderation controls. In a public posting context, this can create harassment, reputational, and policy-compliance risk, especially because the comments are generated automatically after trades.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Check if a SIMILAR market already exists: - Same asset (BTC/ETH/SOL) + same threshold + overlapping timeframe = DUPLICATE - Example: "SOL above $100" + "SOL reclaim $100" = SAME MARKET, don't create - If duplicate exists → SKIP, don't create **STEP 1: LOAD CONTEXT**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The resolution cron uses credentials, performs external API reads and authenticated resolve actions, and logs silently with NO_REPLY output. Silent authenticated actions against markets can change financial outcomes and conceal mistakes or abuse, especially when resolution decisions are automated from parsed titles and third-party data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md For CRYPTO — Binance may be geo-blocked, use CoinGecko as primary: # CoinGecko (no geo-restrictions): curl -s "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin,ethereum,solana&vs_currencies=usd" # Response: { "bitcoin": { "usd": 75000 }, ... } # Binance fallback (may fail in some regions):
Static analysis
No suspicious patterns detected.