OpenClaw Decision Support

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:41 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent read-only Polymarket decision support, but it needs review because it combines broad automatic activation with bearer-token API use documented over plain HTTP.

Install only if you are comfortable with an implicitly invokable prediction-market analysis skill. Configure the API endpoint with HTTPS for any non-local host, use a narrow read-only token, rotate it if exposed, and treat outputs as review candidates rather than trade instructions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:22

Finding

Bearer Token May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-27 and references/agent-api.md:7-24
Vulnerability Type: Plaintext transmission of a bearer token
Risk Level: Medium

Vulnerable Code

From SKILL.md:22-27:

bash

OPENCLAW_AGENT_API_BASE_URL=http://your-host:8080/api/v1/agent
OPENCLAW_AGENT_API_KEY=your-own-bearer-token

From references/agent-api.md:7-24:

bash

OPENCLAW_AGENT_API_BASE_URL=http://your-host:8080/api/v1/agent
OPENCLAW_AGENT_API_KEY=your-own-bearer-token

text

- send `Authorization: Bearer $OPENCLAW_AGENT_API_KEY`
- treat `OPENCLAW_AGENT_API_BASE_URL` as the canonical base path

Technical Analysis

The documented configuration uses an http:// API URL while directing the agent to transmit the API key as a bearer credential in the HTTP Authorization header. Plain HTTP provides neither transport confidentiality nor authenticated server identity.

If the configured host is remote or traffic crosses an untrusted network, an attacker with a suitable network position could inspect or modify requests. Because bearer tokens are usable by possession, interception may allow immediate credential replay without knowledge of an additional secret.

The issue is configuration-dependent: use of a loopback address or a separately secured trusted tunnel would reduce exposure. However, the example uses the generic remote-looking hostname your-host and does not restrict plaintext HTTP to loopback connections.

Attack Path

1. A user follows the documented example and configures a non-loopback API endpoint using http://.
2. The skill calls the endpoint and sends Authorization: Bearer $OPENCLAW_AGENT_API_KEY.
3. Traffic traverses a network observable or controllable by an attacker.
4. The attacker captures the bearer token or redirects/modifies the plaintext API exchange.
5. The attacker replays the token against the decision-support API or supplies manipulated market-analysis responses.

Impact Assessment

...[truncated 555 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// for every non-loopback API endpoint.

2. Replace the generic plaintext example with an HTTPS example:

   bash

   OPENCLAW_AGENT_API_BASE_URL=https://your-host.example/api/v1/agent
   OPENCLAW_AGENT_API_KEY=your-own-bearer-token
   

3. If plaintext HTTP is needed for local development, explicitly restrict it to loopback addresses such as http://127.0.0.1:8080 or http://localhost:8080.

4. Validate the configured URL before issuing requests and reject http:// when the host is not loopback.

5. Use TLS certificate validation and do not permit insecure certificate bypasses.

6. Issue short-lived, narrowly scoped, read-only tokens and support prompt revocation and rotation.

7. Ensure the backend token cannot access trading, wallet, administrative, or unrelated endpoints.

8. Document trusted tunnels or mutually authenticated TLS for deployments that cannot expose HTTPS directly.

9. Apply the same changes consistently in both SKILL.md and references/agent-api.md.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill uses the bare trigger word 'analyze' to enter a privileged workflow, which is broad enough to match common conversational requests that may not intend to invoke this trading-analysis skill. In an agent environment, this can cause accidental activation, unnecessary API access, and routing of unrelated user input into market-analysis behavior, increasing the chance of unintended actions or context leakage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Phrases like 'analyze this' and especially 'equivalent phrasing' are ambiguous and open-ended, making the activation boundary hard to enforce safely. In practice, this can let ordinary dialogue or unrelated content trigger deep-analysis mode, causing misrouting, over-broad API calls, and unintended processing of arbitrary URLs or identifiers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The analyze-intent examples include broad natural-language forms that are not tightly bound to a specific skill invocation contract. Because this skill can query backend APIs and process external market references, accidental triggering from generic 'analyze' phrasing increases the risk of unintended tool use and cross-skill confusion in a larger agent system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation while providing only a broad, marketing-style description of when it should be used. That can cause the agent to auto-route user requests into market-analysis behavior in situations the user did not clearly intend, increasing the chance of unwanted financial guidance or unintended handling of sensitive trading-related prompts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-api.md (reported line 110)May include surrounding context.

md

- `/events*` is the PM-official discovery layer
- `/markets*` is the local trading-evaluation layer
- do not treat `/events` results as final conclusions without checking `/markets/{market_id}/check`

Current local sports coverage note:

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/agent-api.md (reported line 74)May include surrounding context.

md

- `tag_slug`
  - PM official tag slug such as `nba`, `soccer`, `sports`, `politics`
  - use this first when the user needs to expand scope beyond the current local refresh universe
- `order`
  - PM official event ordering field
  - default is `volume24hr`