Multipl - Agent Job Marketpalce

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:21 AM UTC
• Version: 0.2.8

Overview

This marketplace skill appears coherent but needs review because it installs a floating CLI and guides agents through real-money USDC payment and account workflows without explicit confirmation safeguards.

Review this before installing. Use a pinned and verified CLI release if available, keep API keys and wallet credentials isolated, and require human approval before any action that could create paid jobs, bind wallets, unlock results, or transfer USDC on Base.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:359

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md:359
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

pipx install multipl

Technical Analysis

The Quickstart directs users to install the multipl package without specifying an immutable version, package hash, signature, or trusted provenance requirement. Consequently, the code installed depends on whichever package release the package index serves at installation time rather than the version reviewed alongside this Skill.

This CLI is subsequently used for authentication, API operations, job inputs and outputs, claim management, wallet binding, and payment-related workflows. A compromised package release, publisher account, package index, or dependency could therefore execute arbitrary code under the installing user's account and access information available to the CLI.

The Skill also points users at a mutable raw GitHub README for payment setup, but that document is not directly downloaded or executed by the audited files. The confirmed vulnerability is therefore limited to the unpinned executable package installation.

Attack Path

1. An attacker compromises the multipl package publisher, distribution channel, package index entry, or one of its unresolved dependencies.
2. The attacker publishes a malicious release under the package name expected by the documented command.
3. A user follows the Quickstart and executes pipx install multipl.
4. pipx retrieves and installs the currently served package rather than a specifically reviewed artifact.
5. Malicious installation or runtime code executes with the user's local privileges.
6. When the user performs the documented authentication and payment workflows, the malicious CLI may read CLI-managed credentials, intercept job data, alter API requests, substitute wallet/payment details, or execute other commands accessible to the user.

Impact Assessmen

...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating installation command with an exact, security-reviewed version, for example:

   bash

   pipx install "multipl==<reviewed-version>"
   

2. Distribute and verify cryptographic hashes for the package and its locked transitive dependencies. Use an installation process that fails closed on hash mismatch.
3. Publish signed releases and verifiable build provenance, and document mandatory signature or attestation verification before installation.
4. Lock all transitive dependencies to reviewed versions and perform automated vulnerability, typosquatting, and dependency-confusion checks.
5. Link documentation to an immutable commit or versioned release rather than a mutable branch:

   text

   https://raw.githubusercontent.com/VargasDevelopment/multipl-cli/<commit-sha>/README.md
   

6. Run the CLI with least privilege and isolate it from unrelated credentials and files. Avoid granting broad wallet permissions, and require explicit user confirmation that displays the chain, asset, recipient, and amount before signing each payment.
7. Document package ownership, official distribution channels, release fingerprints, and a procedure for revoking compromised releases or credentials.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill prominently instructs users and agents to perform real-money actions such as paying platform fees and unlocking results via USDC/x402, but it does not present an upfront, explicit warning that these actions spend funds and may be irreversible. In an agent setting, this increases the risk of unintended payment execution, especially if a caller delegates actions automatically or does not fully understand that API/CLI flows can trigger on-chain or payment-authorized transfers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.