Security audit

MoltsPay Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is payment-focused and mostly coherent, but it automatically installs and initializes unpinned wallet/payment tooling and can steer broad user requests into real-money payment flows.

Review this before installing. It is intended to let an agent create or use a wallet and spend funds for AI services. Use it only in an isolated environment, prefer testnet or low balances, require manual confirmation for every payment, and avoid running the current postinstall/global install path unless the moltspay CLI version and provenance are pinned and reviewed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: scripts/setup.js:30
Finding: Automatic Installation and Execution of an Unpinned Third-Party Payment Package
Content: View full analysis
/dev/null; then echo "📦 Installing moltspay..." npm install -g moltspay echo "✅ moltspay installed" else ``` ### Technical Analysis The project does not declare an exact, reviewed version of `moltspay`, provide a lockfile or integrity constraint for it, or bundle a reviewed implementation. Instead, its `postinstall` lifecycle hook invokes `scripts/setup.js`, which runs `npm install -g moltspay`. This resolves and downloads whichever release is current in the configured npm registry at installation time. Consequently, the code audited in this project doe ...[truncated 2852 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill’s declared behavior and its documented/expected operational behavior do not align: it claims safe, scoped service discovery and payment orchestration, but the finding indicates additional capabilities such as package installation, wallet initialization/configuration, and persistent wallet data handling. This is dangerous because users or orchestrators may invoke the skill under a narrower trust assumption than what it actually does, leading to unexpected system modification, sensitive wallet creation, or local state persistence tied to financial operations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger list includes very broad, common terms such as "pay", "buy", "video", and especially "generate", which can cause the skill to activate for many unrelated user requests. In a payment-enabled skill that auto-discovers external services, unintended activation increases the chance of steering users into payment flows or interacting with untrusted services without clear intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README prominently advertises autonomous payment capability across crypto and Alipay but does not present a clear upfront warning that commands may initiate real-money transactions affecting user funds. In an agent skill that can auto-discover services and pay them, missing safety disclosure increases the risk of accidental or socially engineered spending, especially if users assume examples are low-risk demos.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx moltspay without pinning an exact package version. npx fetches the latest published package at execution time, so a compromised maintainer account, malicious update, or dependency-chain attack could cause users or agents to execute attacker-controlled code. In a payment-oriented skill, that code could access wallets, payment credentials, or alter transaction behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This command example uses unpinned npx moltspay, which causes execution of whatever version is current in the registry at runtime. That creates a supply-chain risk where a malicious release can be silently substituted and then run in a context that handles service discovery and payments. Because the skill is meant for autonomous paid-service use, the blast radius is larger than a typical CLI example.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README again recommends npx moltspay without version pinning, exposing users to registry-side package substitution or malicious updates. Since this command is for service discovery, a malicious package could also manipulate discovered endpoints, steer payments to attacker-controlled services, or exfiltrate environment data before the user notices.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx moltspay status without an exact version still executes remote code from the package registry on demand. Even though this looks like a harmless status command, the package runs with the user's local permissions and may access wallet configuration, API keys, or other secrets. In a financial tool, even read-only-looking commands can be abused for reconnaissance and credential theft.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This final link/example continues the pattern of invoking npx moltspay without version pinning. Repetition in documentation increases the chance that users and downstream agents normalize unsafe execution patterns, making supply-chain compromise more likely to succeed broadly. Given the skill’s role in moving funds, compromise could lead to unauthorized payments or theft.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger is broad enough to activate on common user requests about generating media or using paid services, which can cause the agent to enter a payment-capable workflow without strong user intent verification. In a skill that can initialize wallets, manage balances, and initiate payments, overbroad triggering increases the chance of unintended financial actions or exposure to untrusted external providers.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Including generic terms like 'pay', 'buy', and 'purchase' in the usage triggers without sufficient scoping can match everyday conversations unrelated to this specific payment skill. Because the skill is tied to financial operations and external service access, this broad matching raises the risk of accidental invocation, user confusion, or steering users toward a payment flow they did not specifically request.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup script performs a global npm install -g moltspay, modifying the host environment outside the skill’s local scope. This expands the blast radius of the skill, can introduce supply-chain risk if the package or its dependencies are compromised, and may affect other users or workloads on the host. In this skill’s context, automatically enabling paid-service access and wallet initialization makes host-level installation more sensitive, not less.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.js:16