ClawHub
Back to skill

Security audit

forecast-os-lite

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherently limited to reading public prediction-market data, with ordinary search-privacy and installation considerations.

Keep confidential details out of searches because query terms reach the selected market services. Review and pin the installer and repository revision before running the documented npx commands. Assess the separate full trading skill independently; this review covers the two bundled documents, not external installer code or future upstream changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The installation command invokes an unpinned npm CLI through npx and selects skill content without an immutable revision. Although this is not an MCP server reference as the detector claims, following the command exposes the installer to mutable upstream code; a compromised release could execute with the user's permissions. This is a conditional supply-chain risk, not evidence that the current package is malicious.

Content

No source excerpt is available for this finding.

User-derived search terms are sent to third-party services without a privacy disclosure.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow sends user-derived query terms to Polymarket and Precog through URL parameters, including the Precog searches at lines 154–163 and 188–199. Although the skill identifies its public data sources, it does not warn that search terms leave the conversation and may be logged by those services; read-only access does not prevent this disclosure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The suggested installation command references a mutable npm CLI and an unpinned skill repository, creating a conditional supply-chain exposure if the user runs it. It is not an MCP server configuration, and the explicit prohibition on the agent installing or running the full skill substantially reduces automatic exposure. Nevertheless, a compromised upstream CLI release could execute with the installing user's permissions.

Content

No source excerpt is available for this finding.