Search results

agentcash CLI output not sanitized before injection into LLM context

Status: Open.

#93 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

Wallet private key sent in plaintext on /api/setup/wallet/import endpoint

Status: Open.

#92 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

Prompt injection surface: customInstructions flows directly into LLM system prompt

Status: Open.

#91 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

No CSRF protection on state-changing API endpoints

Status: Open.

#90 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

No authentication on any HTTP API endpoint

Status: Open.

#89 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

Server binds to all interfaces (0.0.0.0) instead of localhost only

Status: Open.

#88 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Low] No mechanism to refresh or rotate LLM API key at runtime

Status: Open.

#87 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Low] Hardcoded WebSocket URL — no environment-based override

Status: Open.

#86 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Medium] Only one test file exists — most critical paths have zero test coverage

Status: Open.

#85 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Medium] Synchronous disk I/O on every log write — blocks the event loop

Status: Open.

#84 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Medium] Memory caches never invalidated on external file changes

Status: Open.

#83 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026

[Critical] No API rate limiting on any HTTP endpoints

Status: Open.

#75 In moltlaunch/cashclaw;

· ether-btc opened on Apr 25, 2026