ClawHub
Back to skill

Security audit

moltnode

Security checks for vulnerabilities and agentic risk

Overview

This skill connects agents to disclosed blockchain RPC and swap-quote services, with explicit user confirmation required before signing or broadcasting transactions.

Install only if you are comfortable sharing blockchain queries, token interests, wallet addresses, and swap intent with MoltNode and Chord. Never provide private keys or seed phrases, and review the exact quote, approval, recipient, value, and simulation status before approving any wallet signature.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill directs the agent to send user-supplied blockchain queries and swap-related data to third-party services at api.getchord.xyz. While this is expected for the skill’s functionality, it still creates an external data transmission path that can disclose wallet addresses, token interests, and trading intent to an external operator.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
| --- | --- |
| JSON-RPC on any chain | `POST https://moltnode.ag/<slug>` with a JSON-RPC 2.0 body (batches allowed) |
| Chain catalog | `GET https://moltnode.ag/api/chains` (slugs, chainIds, which chains Chord trades on) |
| Token lookup (Chord) | `GET https://api.getchord.xyz/v1/tokens/search?chain=<chainId>&q=<symbol or address>` |
| Swap quote + unsigned tx (Chord) | `GET https://api.getchord.xyz/v1/meta/quote?chain=<key>&tokenIn=&tokenOut=&amount=&taker=` |
| MCP server (optional, same tools) | `https://moltnode.ag/mcp` |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
| JSON-RPC on any chain | `POST https://moltnode.ag/<slug>` with a JSON-RPC 2.0 body (batches allowed) |
| Chain catalog | `GET https://moltnode.ag/api/chains` (slugs, chainIds, which chains Chord trades on) |
| Token lookup (Chord) | `GET https://api.getchord.xyz/v1/tokens/search?chain=<chainId>&q=<symbol or address>` |
| Swap quote + unsigned tx (Chord) | `GET https://api.getchord.xyz/v1/meta/quote?chain=<key>&tokenIn=&tokenOut=&amount=&taker=` |
| MCP server (optional, same tools) | `https://moltnode.ag/mcp` |

Slugs and chain keys: [references/chains.md](references/chains.md). Chord trades on `ethereum`, `base`, `monad`, `bnb`, `avalanche`, `arbitrum`, `robinhood` and `arc`.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The token search flow sends user token queries, and potentially contract addresses of interest, to an external service. In a blockchain context this can reveal user research/trading interests and may enable profiling, especially when combined with wallet-linked quote requests elsewhere in the skill.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
## Swapping on an EVM chain (Chord)

1. **Find both tokens.** `GET https://api.getchord.xyz/v1/tokens/search?chain=<chainId>&q=USDC` returns address, decimals and `verified`. Similar tickers are common: prefer `verified: true` and compare addresses. The native coin is `0x0000000000000000000000000000000000000000`. On Monad (143) search returns only off-list tokens; use `GET https://api.getchord.xyz/v1/tokens` for the main list.
2. **Quote with the user's wallet as taker.** Amounts are integer strings in the smallest unit (10 USDC = `10000000`).
   GET `https://api.getchord.xyz/v1/meta/quote` with the query `chain=base`, `tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913`
   (USDC), `tokenOut=0x0000000000000000000000000000000000000000` (ETH), `amount=10000000`, `taker=` the user's wallet address.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The quote endpoint explicitly requires the user’s wallet address as the taker and transmits intended trade parameters to a third party. This exposes wallet-linked trading intent and could be used for profiling, targeting, or commercial exploitation; in the worst case, if logs are mishandled, it may also aid frontrunning or surveillance of high-value users.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
1. **Find both tokens.** `GET https://api.getchord.xyz/v1/tokens/search?chain=<chainId>&q=USDC` returns address, decimals and `verified`. Similar tickers are common: prefer `verified: true` and compare addresses. The native coin is `0x0000000000000000000000000000000000000000`. On Monad (143) search returns only off-list tokens; use `GET https://api.getchord.xyz/v1/tokens` for the main list.
2. **Quote with the user's wallet as taker.** Amounts are integer strings in the smallest unit (10 USDC = `10000000`).
   GET `https://api.getchord.xyz/v1/meta/quote` with the query `chain=base`, `tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913`
   (USDC), `tokenOut=0x0000000000000000000000000000000000000000` (ETH), `amount=10000000`, `taker=` the user's wallet address.
   The answer has `provider`, `amountOut`, `minAmountOut`, `priceImpactPct`, `feeBps`, `route.venues`, `approval`, `tx` and `simulation`. `provider` is `chord` when Chord's router answers; another aggregator's name means Chord had no executable route and the answer says why in `fallbackReason`.
3. **Show the user the quote and get an explicit yes** before anything is signed: amount in, expected and minimum out (in human units), price impact, fee, and whether `simulation.ok` is true. Do not continue if `simulation.ok` is false or `provider` is null.

Static analysis

No suspicious patterns detected.