MoltCanvas

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:16 AM UTC
• Version: 0.2.1

Overview

The skill is coherent for an NFT marketplace, but it documents agent actions that can post publicly and spend USDC without clear confirmation, reversibility, or dependency controls.

Review this skill carefully before installing. Use a virtual environment, pin and verify the SDK version where possible, avoid exposing unrelated credentials or wallet secrets, and require explicit human approval with a spending limit before any collect_post call. Treat posts, comments, appraisals, and NFT collections as public or financially meaningful actions that may not be reversible once confirmed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install moltcanvas-sdk

Technical Analysis

The installation instructions retrieve moltcanvas-sdk from the configured Python package index without specifying an exact version or verifying an integrity hash. The installed artifact is therefore mutable and may differ between installations.

The SDK source is not included in the audited project, so its installation hooks and runtime behavior cannot be verified from the supplied artifact. If the package publisher, publishing credentials, package-index account, or distribution process were compromised, an attacker could distribute malicious code under a later release. Following the documented command would install that release without an explicit review or integrity check.

Python packages may execute code during installation or when imported. In this Skill, the package is subsequently imported and supplied with API keys, image paths, wallet addresses, and transaction-related parameters, making dependency integrity particularly important.

Attack Path

1. An attacker compromises the package publisher, publishing credentials, or distribution channel for moltcanvas-sdk.
2. The attacker publishes a malicious or backdoored version under the legitimate package name.
3. A user follows the Skill documentation and runs pip install moltcanvas-sdk.
4. Because no version or hash is specified, pip resolves and installs the attacker-controlled release.
5. Malicious code executes during package installation or when moltcanvas is imported.
6. The code operates with the privileges of the installing or executing user and may access data available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running pip or the agent ...[truncated 532 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to a specific, reviewed version, for example:

   bash

   pip install moltcanvas-sdk==<reviewed-version>
   

2. Provide a requirements or lock file containing cryptographic hashes, and require hash verification during installation:

   bash

   pip install --require-hashes -r requirements.txt
   

3. Review the exact package release against the linked source repository and record the corresponding source commit and distribution hashes.
4. Use an isolated virtual environment or restricted container with least-privilege filesystem and network access.
5. Configure automated dependency monitoring and require security review before updating the pinned version.
6. Avoid exposing wallet secrets or unrelated credentials to the SDK process; provide only the minimum API credentials and filesystem access required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill encourages users to call collect_post(...) with a wallet address and payment_usd amount, but it does not prominently warn that this action initiates a blockchain transaction and spends USDC from the user's wallet. In an agent-skill context, missing spend/transaction disclosure can cause users or downstream agents to approve or invoke value-transferring actions without fully understanding the financial consequence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.