Scout

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 AM UTC
• Version: 1.0.2

Overview

This skill is not clearly malicious, but it combines trust scoring, wallet payments, API-key-backed services, and automatic DM replies with unsafe or under-disclosed behavior.

Review this carefully before installing. Use only test wallets with minimal funds, keep --dry-run as the default for payments, do not rely on the escrow wording as actual custody protection, avoid running the API server on a reachable network without authentication, and do not run the DM bot unless automatic replies from your Moltbook account are acceptable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/usdc.js:91

Finding

Nonexistent Escrow Is Presented as an Active Payment Safeguard

Content

View full analysis

0 && this.wallet) { try { const balance = await this.getBalance(this.wallet.address); if (balance < upfrontAmount) { result.status = 'INSUFFICIENT_FUNDS'; result.reason = `Need ${upfrontAmount} USDC but only have ${balance} USDC`; return result; } const tx = await this.transfer(toAddress, upfrontAmount); result.transactions.push({ type: 'upfront', ...tx }); } catch (err) { result.status = 'TX_FAILED'; result.reason = err.message; return result; } } if (escrowAmount > 0) { result.escrowNote = `${escrowAmount} USDC held in escrow. Release with: scout release --to ${toAddress} --amount ${escrowAmount}`; } return result; ``` ### Technical Analysis The function calculates an `escrowAmount` but does not transfer that amount to an escrow contract, multisignature wallet, custodial address, or any other controlled mechanism. It merely records a number in the returned object. Despite the absence of an escrow transaction, the function states that the amount is “held in escrow” and provides a `scout release` command. No corresponding release command or e ...[truncated 1489 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-pay.js:49

Finding

Missing Recipient Validation Can Trigger Transfers to the Zero Address

Content

View full analysis

--to --amount --task "description" [--dry-run] [--json] node safe-pay.js --check `); process.exit(1); } ``` ```js const payResult = await (args.dryRun ? mockSafePay(trustResult, args.to, args.amount, args.task) : usdc.safePay( trustResult, args.to || '0x0000000000000000000000000000000000000000', args.amount, args.task || 'unspecified' ) ); ``` The resulting destination is passed to the transfer implementation in `scripts/lib/usdc.js:50-55`: ```js async transfer(toAddress, amount) { if (!this.wallet) throw new Error('No wallet configured - set SCOUT_PRIVATE_KEY'); const decimals = await this.usdc.decimals(); const amountWei = ethers.parseUnits(amount.toString(), decimals); const tx = await this.usdc.transfer(toAddress, amountWei); ``` ### Technical Analysis The required-argument check validates only `args.agent` and `args.amount`; it does not require `args.to`. When a real payment is requested without a recipient, the code silently substitutes the Ethereum zero address. The destination is not validated with `ethers.isAddress`, and the zero address is not explicitly prohibited. Consequently, malformed addresses are rejected only later by the Ethereum library, while an omitted address is deliberately converted into a syntactically valid but unsafe destination. Depending on the token contract's behavior, a transfer to the zero address may revert and consume gas or may irreversibly burn the transferred tokens. The payment operation should fail closed before creating or signing any transaction. The amount check is also incomplete ...[truncated 1441 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/api-server.js:197

Finding

Unauthenticated Public Server Exposes API-Key-Backed Operations

Content

View full analysis

{ const url = new URL(req.url, `http://localhost:${PORT}`); const path = url.pathname; // CORS preflight if (req.method === 'OPTIONS') { res.writeHead(204, { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Payment-Hash', }); return res.end(); } // Route matching const scoreMatch = path.match(/^\/score\/(.+)$/); const reportMatch = path.match(/^\/report\/(.+)$/); if (path === '/' || path === '/health') { return handleHealth(res); } else if (scoreMatch) { return handleScore(res, decodeURIComponent(scoreMatch[1])); } else if (reportMatch) { return handleReport(res, decodeURIComponent(reportMatch[1])); } else if (path === '/compare') { const agents = url.searchParams.get('agents')?.split(',') || []; return handleCompare(res, agents); } else { return json(res, 404, { error: 'Not found', endpoints: [ '/', '/score/:agent', '/report/:agent', '/compare?agents=A,B' ] }); } }); server.listen(PORT, () => { console.log(`\n🔍 Scout Trust API v2.0`); console.log(` http://localhost:${PORT}\n`); }); ``` The server uses the operator's Moltbook credential globally: ```js const API_KEY = process.env.MOLTBOOK_API_KEY; if (!API_KEY) { console.error('Error: MOLTBOOK_API_KEY required'); process.exit(1); } const client = new MoltbookClient(API_KEY); ``` ### Technical Analysis The server does not authenticate callers, enforce authorization, rate-limit requests, restrict concurrency, or cap the number of agents supplied to `/compare`. Each score operation can cause an auth ...[truncated 2133 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to operate only on a single Moltbook profile while claiming broader cross-platform trust evaluation, discovery, comparison, and payment support. In context, this makes the issue more dangerous because the tool is explicitly positioned to influence payment decisions and could create false confidence in counterparties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to operate only on a single Moltbook profile while claiming broader cross-platform trust evaluation, discovery, comparison, and payment support. In context, this makes the issue more dangerous because the tool is explicitly positioned to influence payment decisions and could create false confidence in counterparties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill appears to operate only on a single Moltbook profile while claiming broader cross-platform trust evaluation, discovery, comparison, and payment support. In context, this makes the issue more dangerous because the tool is explicitly positioned to influence payment decisions and could create false confidence in counterparties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill appears to operate only on a single Moltbook profile while claiming broader cross-platform trust evaluation, discovery, comparison, and payment support. In context, this makes the issue more dangerous because the tool is explicitly positioned to influence payment decisions and could create false confidence in counterparties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to operate only on a single Moltbook profile while claiming broader cross-platform trust evaluation, discovery, comparison, and payment support. In context, this makes the issue more dangerous because the tool is explicitly positioned to influence payment decisions and could create false confidence in counterparties.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

node scripts/trust-report.js AgentName

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

node scripts/trust-report.js AgentName

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

node scripts/compare.js Agent1 Agent2 Agent3

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

node scripts/compare.js Agent1 Agent2 Agent3

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

node scripts/scan.js --submolt=general --limit=15

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

node scripts/scan.js --submolt=general --limit=15

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

node scripts/dm-bot.js

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins a transitive dependency on ws 8.17.1, and the supplied finding reports known advisories affecting that exact version, including memory disclosure and denial-of-service conditions. In the context of an agent-trust and payment-gating skill that may communicate with blockchain or remote services, a vulnerable WebSocket library increases risk because untrusted peers or upstream endpoints could trigger service disruption or leak process memory.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module claims to perform read-only Ethereum contract queries, but its ABI encoding is invalid because it derives the 4-byte function selector with SHA-256 instead of Ethereum's required Keccak-256. As a result, eth_call requests will target nonexistent selectors and return incorrect or empty data, causing trust and reputation checks to silently fail or misclassify agents. In this skill, that is especially dangerous because the component is used to decide whether an agent is trustworthy before payment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises capabilities that rely on network access and sensitive environment variables, but it does not declare an explicit tool/permission scope. In an agent environment, missing scope boundaries can cause the skill to receive broader access than users expect, increasing the chance of unintended data exposure or external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents a trust-gated USDC payment command without a prominent warning about real fund transfer risk, chain/network specifics, and the importance of dry-run verification. In a payment context, omission of these safeguards can lead to accidental transfers, misuse, or overconfidence in automated payment decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs users to provide a private key via environment variable but does not include explicit guidance on secure handling, storage, rotation, or avoiding accidental disclosure. Because private keys enable fund movement, poor credential hygiene here could directly result in wallet compromise and asset loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script accesses a sensitive credential via process.env.MOLTBOOK_API_KEY and immediately uses it to initialize a client. While the code logs progress later, there is no comment, docstring, or user-facing notice explaining that the skill depends on and consumes a credential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The call to client.getProfile(name) appears to perform a remote profile lookup, but the file does not provide a user-facing warning or explanatory comment that names are being sent to an external service. For code files, outbound network operations that may transmit user or system data should have some visible disclosure unless already clearly documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code performs on-chain analysis using a user-supplied wallet and later prints detailed transaction and counterparty information. Although progress messages are present, there is no user-facing disclosure that providing a wallet will trigger external analysis and expose potentially sensitive financial metadata in output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bot actively polls unread DMs, parses requests, and automatically sends outbound replies, which expands the skill from passive trust analysis into autonomous messaging behavior. That creates account-action capability with potential for spam, abuse, or unintended interactions if triggered by arbitrary inbound messages, especially since every unread message from non-Fledge senders is processed automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code sends DM replies immediately after processing inbound messages, with no user confirmation, approval workflow, or visible warning. In a trust-scoring skill, autonomous outbound messaging increases the risk of unwanted communications, reputation damage, and accidental responses to malicious or malformed prompts sent via DM.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/onchain.js (reported line 28)May include surrounding context.

js

key: opts.basescanKey || '',
      },
      'base': {
        url: 'https://api.basescan.org/api',
        key: opts.basescanKey || '',
      },
      'ethereum': {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/onchain.js (reported line 32)May include surrounding context.

js

key: opts.basescanKey || '',
      },
      'ethereum': {
        url: 'https://api.etherscan.io/api',
        key: opts.etherscanKey || '',
      }
    };

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module transmits user-supplied wallet addresses and associated query metadata to third-party explorer APIs (Basescan/Etherscan) without any disclosure, consent flow, or privacy control in this code path. Wallet addresses are pseudonymous rather than secret, but they can still reveal financial history, activity patterns, and linkages once sent to external providers, which is especially relevant in a trust-scoring skill that may process many agent identities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.