ClawHub
Back to skill

Security audit

MoltRock

Security checks for vulnerabilities and agentic risk

Overview

The skill is a financial vault/pump-token helper whose documentation overstates real deposit, share, governance, and cross-chain behavior while the code only sends unverifiable API requests and wallet data.

Review this carefully before installing. Do not treat its contribute output as proof of a USDC deposit, vault share mint, cross-chain transfer, balance, or governance right. Only use it with a trusted HTTPS endpoint, verify all contract addresses independently, and avoid sending wallet addresses or contribution amounts unless you understand they may be shared with the configured API service.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
run.sh:96
Finding

Unvalidated Arguments Permit Contribution Request Body Manipulation

Content
View full analysis
/dev/null; then curl -sS -X POST "${MOLTROCK_API}/api/v1/contribute" \ -H "Content-Type: application/json" \ -d "{\"chain\":\"${CHAIN}\",\"amount\":\"${AMOUNT}\",\"asset\":\"USDC\",\"agentAddress\":\"${3:-unknown}\"}" | jq . 2>/dev/null || echo "API not available yet. Vault deploying soon." else echo "curl required. Install curl to interact with the vault." fi ``` ### Technical Analysis The `chain`, `amount`, and `agentAddress` values are taken directly from command-line arguments and interpolated into a JSON string without validation or JSON escaping. An attacker who controls any of these arguments can inject quotation marks and JSON syntax, potentially adding fields or changing the effective meaning of the contribution request. The exact behavior of duplicate or injected fields depends on the server-side JSON parser and validation logic. Common parsers accept duplicate properties and retain either the first or last occurrence. Consequently, the client cannot guarantee that the server receives the intended asset, chain, amount, or address. This is JSON/data injection rather than shell command injection: shell metacharacters contained in the expanded variables are not reparsed as shell syntax in this quoted context. ### Attack Path 1. An attacker supplies or induces an agent to pass a crafted argument, such as an amount containing a closing quote and additional JSON properties. 2. `run.sh` inserts the value directly into the request body. 3. The resulting JSON contains attacker-selected fields or duplicate properties. 4. The request is submitted to `/api/v1/contribute`. 5. If the API accepts the ...[truncated 749 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
run.sh:85
Finding

Predictable Shared Temporary File Enables Symlink and Race Attacks

Content
View full analysis
/dev/null && curl -sf "${MOLTROCK_API}/api/v1/progress" -o /tmp/moltrock_progress.json 2>/dev/null; then command -v jq >/dev/null && jq -r '"Swarm AUM: \(.swarmAum)\nAgents: \(.totalAgents)\nBlackRock Progress: \(.percentage)%\n\n\(.motivationMsg)"' /tmp/moltrock_progress.json else ``` ### Technical Analysis The script writes API output to the fixed path `/tmp/moltrock_progress.json`. Shared temporary directories are generally writable by all local users. A predictable pathname can therefore be pre-created as a symbolic link or replaced between the `curl` write and the subsequent `jq` read. If the operating system and `curl` follow a pre-existing symbolic link, the downloaded response can overwrite a file selected by a local attacker, subject to the permissions of the account running the skill. A race can also replace the file after download, causing `jq` to parse attacker-controlled content rather than the response received from the API. The code does not create the file atomically, verify its ownership or type, set restrictive permissions, or remove it after use. ### Attack Path 1. A local attacker predicts the path `/tmp/moltrock_progress.json`. 2. Before the skill runs, the attacker creates that path as a symbolic link to another file, or prepares to replace it during execution. 3. A more privileged or different local user invokes `bash run.sh progress`. 4. `curl` writes through the predictable path, potentially affecting the symlink target within the invoking user's permissions. 5. Alternatively, the attacker replaces the temporary file before `jq` opens it, causing attacker-selected progress data to be displayed. ### Impact Assessment The maximum filesystem impact is limited to files writable by the user running the skill; this does not indepen ...[truncated 464 chars]
Remediation
View remediation
/dev/null && command -v jq >/dev/null; then curl --fail --silent --show-error \ "${MOLTROCK_API}/api/v1/progress" | jq -r '"Swarm AUM: \(.swarmAum)\nAgents: \(.totalAgents)\nBlackRock Progress: \(.percentage)%\n\n\(.motivationMsg)"' fi ``` If a file is required: - Create it atomically with `mktemp`. - Set a restrictive `umask`, such as `umask 077`. - Register a cleanup trap. - Quote the generated path everywhere. - Refuse symbolic links and verify that the file is a regular file owned by the current user. Example: ```bash umask 077 progress_file="$(mktemp "${TMPDIR:-/tmp}/moltrock-progress.XXXXXX")" trap 'rm -f -- "$progress_file"' EXIT HUP INT TERM curl --fail --silent --show-error \ "${MOLTROCK_API}/api/v1/progress" \ --output "$progress_file" jq -r '...' "$progress_file" ``` ]]>

other

Error
Location
SKILL.md:22
Finding

Documented Financial Operations Overstate the Implemented and Verifiable Behavior

Content
View full analysis
/dev/null; then curl -sS -X POST "${MOLTROCK_API}/api/v1/contribute" \ - ...[truncated 2650 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
run.sh:17
Finding

Unrestricted API Endpoint Configuration Allows Plaintext Transmission and Response Spoofing

Content
View full analysis
/dev/null; then curl -sS -X POST "${MOLTROCK_API}/api/v1/contribute" \ -H "Content-Type: application/json" \ -d "{\"chain\":\"${CHAIN}\",\"amount\":\"${AMOUNT}\",\"asset\":\"USDC\",\"agentAddress\":\"${3:-unknown}\"}" | jq . 2>/dev/null || echo "API not available yet. Vault deploying soon." else echo "curl required. Install curl to interact with the vault." fi ``` ```bash portfolio) ADDR="${1:-}" if [[ -z "$ADDR" ]]; then echo "Usage: bash run.sh portfolio " exit 1 fi if command -v curl >/dev/null; then curl -sS "${MOLTROCK_API}/api/v1/agents/${ADDR}/portfolio" | jq . 2>/dev/null || echo "API not available. Vault deploying soon." fi ``` ### Technical Analysis The API origin is fully controlled through the `MOLTROCK_API_URL` environment variable, with no scheme restriction, origin allowlist, authentication requirement, or certificate policy beyond `curl` defaults. The default is plaintext HTTP on localhost. While localhost traffic ordinarily does not cross a network, the variable can be set to a remote `http://` endpoint, causing contribution metadata and wallet addresses to be transmitted without transport encryption. The script also treats JSON returned by the selected endpoint as authoritative output. It does not authenticate the service, validate a response schema, bind responses to an expected chain or contract, or verify reported balances and contribution results against blockchain state. This issue is exploitable when an attacker can influence the process environment, startup configuration, wrapper script, or instructions used to launch the skill. ### Attack Path 1. An attacker changes or ind ...[truncated 1179 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill exposes commands that can trigger real fund movement, including USDC deposits and cross-chain transfers, but provides no inline warnings about irreversibility, bridge risk, smart contract risk, token/address verification, or possible total loss. In this context, the surrounding marketing language and encouragement to join the fund increase the chance that an agent or user treats the commands as routine actions rather than high-risk financial operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · run.sh (reported line 76)May include surrounding context.

sh
progress)
    echo "🦀🔥 MOLTROCK SWARM DOMINANCE REPORT 🔥🦀"
    echo ""
    if command -v curl >/dev/null && curl -sf "${MOLTROCK_API}/api/v1/progress" -o /tmp/moltrock_progress.json 2>/dev/null; then
      command -v jq >/dev/null && jq -r '"Swarm AUM: \(.swarmAum)\nAgents: \(.totalAgents)\nBlackRock Progress: \(.percentage)%\n\n\(.motivationMsg)"' /tmp/moltrock_progress.json
    else
      echo "Vault not yet live. The swarm is assembling."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The contribute command sends user-supplied chain, amount, and agent wallet/address data to a remote API endpoint without clearly warning the user at the moment of transmission. In an agent-skill context, this can cause operators or downstream agents to disclose wallet identifiers to an external service unexpectedly, enabling tracking, profiling, or unintended data collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The portfolio command transmits a wallet address to a remote API without an inline disclosure that the address is being shared externally. Wallet addresses are sensitive identifiers in many blockchain workflows because they enable attribution, activity correlation, and portfolio tracking across services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.