MoltMarkets Trading Agent

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:46 AM UTC
• Version: 1.0.0

Overview

This skill is transparent about being an autonomous trading setup, but it enables quiet scheduled actions that can use stored credentials to trade, create markets, post comments, and resolve outcomes.

Install only if you are comfortable with an autonomous bot making real MoltMarkets account changes. Use a low-balance or test account, protect or replace the plaintext credentials file, enable logs or notifications, review each cron before adding it, and avoid automatic resolution unless you accept the risk of incorrect or hard-to-reverse outcomes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill is marketed as a complete autonomous trading-agent setup, but the file only provides partial setup instructions and defers critical behavior to external references and manual cron creation. This can mislead users into deploying a system they do not fully understand, especially one that may later perform autonomous financial actions, increasing the risk of unsafe or unintended operation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup instructions direct the user to store an API key and account identifiers in a local plaintext JSON file under the home directory without any warning about secrecy, file permissions, or safer secret-management options. If the workstation is multi-user, backed up insecurely, synced, or later exposed by other tools, the credentials could be stolen and used to control the trading account.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs users to create recurring cron jobs for trader, creator, and resolution agents but does not prominently warn that these jobs will autonomously place trades, create markets, and resolve outcomes on a schedule. In a financial context, unattended automation can cause repeated monetary loss, market abuse, or operational mistakes if misconfigured or if upstream logic is flawed.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes market resolution and committee-vote endpoints that can permanently determine market outcomes, but it does not warn users that these actions are irreversible or require strong safeguards before use. In the context of an autonomous trading/resolution agent, this omission increases the risk that an agent or operator will invoke resolution actions prematurely, incorrectly, or based on manipulated external data, causing irreversible financial and integrity harm.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The trader cron explicitly instructs the agent to act silently, place trades, post comments, and update local memory without clear user-facing disclosure or runtime confirmation. In an autonomous trading context, silent side effects increase the risk of unauthorized financial actions and make detection, audit, and intervention harder.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The creator cron is designed to create markets and write ROI tracking data while returning NO_REPLY, which hides impactful actions from the operator. Because market creation can commit funds and create externally visible content, doing so silently is risky and undermines informed consent and oversight.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The resolution cron silently accesses credentials, queries external services, and resolves markets without user-facing confirmation. Automatic resolution is a high-impact financial/administrative action, and silent execution magnifies the chance of irreversible mistakes, abuse, or unnoticed compromise.

External Transmission

Medium

• Category: Data Exfiltration

Content

- "below/under" + price > threshold → NO

**STEP 5: CALL RESOLVE ENDPOINT**
curl -X POST "$API/markets/{market_id}/resolve" \\
  -H "Authorization: Bearer $API_KEY" \\
  -H "Content-Type: application/json" \\
  -d '{"outcome": "YES", "resolution_note": "BTC was $74,832 at 19:15:59 UTC (Binance 1m kline)"}'

• Confidence: 91% confidence
• Finding: curl -X POST "$API/markets/{market_id}/resolve" \\ -H "Authorization: Bearer $API_KEY" \\ -H "Content-Type: application/json" \\ -d

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/moltmarkets

# Save your credentials (get API key from moltmarkets.com settings)
cat > ~/.config/moltmarkets/credentials.json << 'EOF'
{
  "api_key": "mm_your_api_key_here",
  "user_id": "your-user-uuid",

• Confidence: 98% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

kind: 'agentTurn',
      message: `MARKET AUTO-RESOLUTION — HISTORICAL PRICE LOGIC

**CREDS:** ~/.config/moltmarkets/credentials.json
**API:** https://api.zcombinator.io/molt

**STEP 1: FIND MARKETS TO RESOLVE**

• Confidence: 94% confidence
• Finding: credentials.json

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Use POST /markets/{id}/comments endpoint after placing a bet.

**OUTPUT RULES:**
- NO intermediate messages
- NO spawn announcements — work SILENTLY
- ONLY send ONE final report with: position taken (or why skipped), learning context applied, new balance

• Confidence: 93% confidence
• Finding: OUTPUT RULES

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.