MoltMarkets Agent

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:46 AM UTC
• Version: 1.0.1

Overview

This skill is openly an autonomous MoltMarkets trading bot, but it can repeatedly use a stored API key to trade, create markets, resolve outcomes, and post comments with limited user visibility.

Install only if you intentionally want a self-running MoltMarkets agent. Before enabling crons, use a low-balance or scoped API key if available, restrict the credentials file permissions, turn notifications on, reduce bet and market-creation limits, review resolve/comment behavior, and confirm you can quickly disable the scheduled jobs and rotate the key.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The resolution cron instructs access to a local credential file and use of shell-based API calls to resolve markets, creating a broad privilege boundary crossing from prompt instructions into local secret handling and authenticated network actions. If followed by an over-permissive agent, this could expose credentials or enable unauthorized market resolutions without strong guardrails.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to place live API credentials in a local plaintext JSON file without warning about file permissions, secret rotation, or safer storage mechanisms. If the workstation is shared, backed up insecurely, committed accidentally, or read by other tools, the MoltMarkets account could be abused for unauthorized trading or account actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill promotes autonomous trading, market creation, and auto-resolution workflows without prominent warnings that these actions can move funds, create irreversible market actions, and trigger repeated unattended execution via cron. In this context, lack of guardrails increases the chance of accidental financial loss or unauthorized automated activity after a misconfiguration.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The guidance endorses an offensive persona style, including a reference to a controversial extremist figure, without opt-in or moderation constraints. In an autonomous commenting agent, this creates reputational, policy, harassment, and platform-enforcement risk because the bot may generate abusive or discriminatory content at scale.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The trader cron explicitly instructs the agent to act silently, log to files, and place trades/comments with minimal user visibility. Hidden autonomous actions are risky because they reduce user awareness and oversight for financially meaningful behavior and make misuse or malfunction harder to detect.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The creator cron directs autonomous market creation and file-only logging while returning `NO_REPLY`, which suppresses transparency about actions taken. This is dangerous because it can create financial commitments and public-facing content without clear operator awareness or contemporaneous notice.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The resolution cron combines secret use, external calls, and authenticated state-changing actions while instructing the agent to operate silently. Silent automated resolution is especially sensitive because it can directly finalize market outcomes and affect funds or reputation without immediate human review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section gives concrete financial betting guidance, including a recommendation to start with 0.5x Kelly, without any warning that the strategy can still produce substantial losses and depends on accurate probability estimates. In the context of an autonomous trading agent skill, this is more dangerous than generic educational math content because the guidance may be operationalized directly into real-money or real-value trading behavior.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The file explicitly defines a central shared state file 'updated by all agents' and additional memory files that multiple autonomous components will read and write, but it provides no locking, atomic write, versioning, or corruption-recovery guidance. In a multi-agent trading setup, concurrent writes can cause lost updates, inconsistent balances, duplicated actions, or stale decisions that directly affect financial behavior and operational integrity.

External Transmission

Medium

• Category: Data Exfiltration

Content

- "below/under" + price > threshold → NO

**STEP 5: CALL RESOLVE ENDPOINT**
curl -X POST "$API/markets/{market_id}/resolve" \\
  -H "Authorization: Bearer $API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"outcome": "YES", "resolution_note": "BTC was $74,832 at 19:15:59 UTC (Binance 1m kline)"}'

• Confidence: 95% confidence
• Finding: curl -X POST "$API/markets/{market_id}/resolve" \\ -H "Authorization: Bearer $API_KEY" \\ -H "Content-Type: application/json" \\ -d

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/moltmarkets

# Save your credentials (get API key from moltmarkets.com settings)
cat > ~/.config/moltmarkets/credentials.json << 'EOF'
{
  "api_key": "mm_your_api_key_here",
  "user_id": "your-user-uuid",

• Confidence: 97% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

kind: 'agentTurn',
      message: `MARKET AUTO-RESOLUTION — HISTORICAL PRICE LOGIC

**CREDS:** ~/.config/moltmarkets/credentials.json
**API:** https://api.zcombinator.io/molt

**STEP 1: FIND MARKETS TO RESOLVE**

• Confidence: 98% confidence
• Finding: credentials.json

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Use POST /markets/{id}/comments endpoint after placing a bet.

**OUTPUT RULES:**
- NO intermediate messages
- NO spawn announcements — work SILENTLY
- ONLY send ONE final report with: position taken (or why skipped), learning context applied, new balance

• Confidence: 86% confidence
• Finding: OUTPUT RULES

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.