ClawHub
Back to skill

Security audit

Polymarket OpenClaw Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for Polymarket trading operations, but it gives agents broad authority to run and restart live financial trading code with private-key configuration and limited safeguards.

Review this skill carefully before installing. Use paper mode first, avoid funding the configured wallet heavily, review dependencies and cli_bot.py before running them, require explicit approval before any live launch or restart, remove --yes from production deploys, and do not commit secrets or unreviewed memory content.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:155
Finding

Execution of Unreviewed Project Code and Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155-165
Vulnerability Type: Unreviewed dependency installation and arbitrary project-code execution
Risk Level: High

Vulnerable Code

bash
cd <PROJECT_DIR>
python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
nohup env PYTHONUNBUFFERED=1 python3 cli_bot.py loop > logs/runner_v2.log 2>&1 < /dev/null &

Technical Analysis

The Skill is intended to operate against an arbitrary user-provided project directory. It instructs the agent to install all packages named in requirements.txt and then execute cli_bot.py without first requiring source review, dependency pinning, hash verification, package-origin validation, or integrity checks.

Python package installation may execute package build logic during installation. The subsequent invocation of cli_bot.py directly executes project-controlled Python code. Because the workflow also expects a Polymarket private key and wallet configuration to be available through .env, malicious project code or a compromised dependency could access highly sensitive trading credentials.

The use of a virtual environment limits Python package placement but does not sandbox processes or prevent access to the user's files, environment variables, network, wallet credentials, or other resources available to the invoking account.

Attack Path

  1. An attacker supplies or modifies the designated project directory.
  2. The attacker adds a malicious dependency to requirements.txt, compromises an existing dependency source, or inserts malicious behavior into cli_bot.py.
  3. The agent follows the Skill and runs pip install -r requirements.txt.
  4. Malicious package installation logic may execute with the permissions of the invoking user.
  5. The agent launches cli_bot.py, causing any project-controlled Python payload to execute.
  6. The paylo ...[truncated 597 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a source-code security review of cli_bot.py, imported local modules, package configuration, and installation hooks before execution.
  2. Require exact dependency versions and cryptographic hashes, preferably through a reviewed lockfile and pip install --require-hashes.
  3. Restrict package installation to explicitly approved indexes and disable unexpected extra indexes.
  4. Check packages for typosquatting, dependency confusion, known vulnerabilities, and unexpected source distributions.
  5. Run the project in an isolated, least-privilege container or dedicated account with narrowly restricted filesystem and network access.
  6. Do not expose live private keys during installation or initial testing. Use paper mode and test credentials first.
  7. Inject live credentials only after code integrity has been verified, and use a wallet with limited funds and permissions where possible.
  8. Require explicit user approval before installing dependencies or running code from a newly selected project directory.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:50
Finding

Unsafe Unattended Execution and Automatic Restart of Financial Trading Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-61
Vulnerability Type: Uncontrolled background execution and automatic restart
Risk Level: High

Vulnerable Code

bash
nohup env PYTHONUNBUFFERED=1 python3 cli_bot.py loop > logs/runner_v2.log 2>&1 < /dev/null &
bash
ps -ef | grep 'python3 cli_bot.py loop' | grep -v grep
tail -n 120 logs/runner_v2.log

The accompanying instruction requires the process to be automatically restarted and verified if it is not running.

Technical Analysis

The Skill launches a financial trading process as a detached background job and directs the agent to restart it automatically if it disappears. It does not require the agent to verify EXECUTION_MODE, confirm whether live trading is authorized, validate the active configuration, check code integrity, identify why the process stopped, or obtain renewed approval before restarting.

The process check relies on matching a command-line string rather than a securely managed service identity or recorded PID. This can misidentify processes and does not prove that the expected code, configuration, working directory, or user owns the matching process.

Automatic restart is particularly hazardous for trading software because stopping the process may be an intentional emergency response. Relaunching it can negate that response and resume financial operations after configuration tampering, abnormal termination, or an explicit manual stop.

Attack Path

  1. The bot is configured for live execution, whether intentionally or through configuration error.
  2. An attacker or operational failure modifies the strategy, runtime settings, project code, or trading limits.
  3. The process exits, crashes, or is manually stopped to prevent further trading.
  4. The agent observes that the command-line pattern is absent.
  5. Following the Skill, the agent automatically restarts the process without renewed ...[truncated 632 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before every live-mode launch or restart.
  2. Verify and display the effective execution mode, wallet address, order limits, strategy parameters, and target project path before launch.
  3. Refuse automatic restart after an unexplained crash, manual stop, integrity-check failure, geoblock response, or risk-control violation.
  4. Use a supervised service with an explicit PID file, fixed working directory, dedicated user, bounded restart count, and restart backoff.
  5. Validate hashes or signed versions of executable project files and critical configuration before each restart.
  6. Add a documented stop command and a persistent operator-controlled kill switch that automated restart logic cannot override.
  7. Default to paper trading. Require a separate, time-limited authorization step to enable live trading.
  8. Record restart reasons and require review of relevant logs before resuming financial operations.

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:127
Finding

Unscoped Persistent Workspace Memory Modification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127-131
Vulnerability Type: Persistent memory poisoning through unrestricted state updates
Risk Level: Medium

Vulnerable Instruction

text
After each key change:
1. Update the project memory file if the workspace has a memory system.
2. Commit the change with git.

Technical Analysis

The Skill instructs the agent to update persistent project memory after every key change, but it does not define an approved schema, permitted data sources, project boundaries, or prohibited content. It also does not require user review before the persistent state is written.

If information originating from project files, logs, external services, market data, or other untrusted sources is summarized into memory, attacker-controlled instructions or false operational facts may survive beyond the current session. Future agents may then treat the persisted content as trusted workspace context.

The instruction also lacks an explicit prohibition against storing credentials, wallet details, webhook URLs, private operational data, or raw external content. Committing such memory changes can extend their lifetime and distribute them through repository history.

Attack Path

  1. An attacker places misleading instructions or operational claims in a project file, log entry, generated output, or externally sourced response.
  2. The agent interprets the resulting state as a key change.
  3. Following the Skill, the agent writes a summary or the untrusted content into the workspace memory system.
  4. The memory file is committed to version control.
  5. A later session loads the persisted memory and treats the attacker-influenced content as trusted context.
  6. The later agent may alter trading behavior, disclose information, execute inappropriate commands, or retain unsafe configuration based on the poisoned state.

Impact Assessment

Exploitation can influence futur ...[truncated 505 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic memory updates, or require explicit user approval before each persistent write.
  2. Define a strict schema limited to non-sensitive factual state, such as reviewed configuration version identifiers and user-approved operational notes.
  3. Prohibit storing private keys, wallet secrets, webhook URLs, authentication tokens, raw logs, external instructions, or untrusted generated content.
  4. Treat all project files, logs, web responses, and market data as untrusted input and never persist embedded instructions from those sources.
  5. Restrict writes to a project-specific memory file and prevent modification of global or cross-project agent memory.
  6. Show the proposed memory diff to the user before writing or committing it.
  7. Apply secret scanning and content validation before commits, and provide a documented rollback and history-removal procedure.
  8. Clearly label persisted entries with their source, timestamp, approval status, and verification state.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

python3 -m venv .venv . .venv/bin/activate pip install -r requirements.txt cp .env.example .env

填写必要环境变量后

nohup env PYTHONUNBUFFERED=1 python3 cli_bot.py loop > logs/runner_v2.log 2>&1 < /dev/null &

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

启动：

bash
nohup env PYTHONUNBUFFERED=1 python3 cli_bot.py loop > logs/runner_v2.log 2>&1 < /dev/null &

巡检：

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

启动：

bash
nohup env PYTHONUNBUFFERED=1 python3 cli_bot.py loop > logs/runner_v2.log 2>&1 < /dev/null &

巡检：

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill directs a production deployment using vercel --prod --yes, which suppresses interactive confirmation and can publish changes immediately without ensuring the user understands the consequences. In a trading-related skill, this increases the chance of accidental exposure of unfinished code, misconfiguration, or unintended activation of a user-facing control plane.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instructions throughout the skill are presented in Chinese, which effectively forces a specific language without indicating that the user can choose another language. The policy requires either user choice/opt-in or a clearly justified locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.