ClawHub
Back to skill

Security audit

Polymarket World Cup Delta Pairs

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is not clearly malicious, but it can place real-money trades and has weak safeguards around partial execution and account access.

Review before installing. Use a restricted Simmer API key if available, run dry-run or sim mode first, avoid --live and --no-safeguards unless you explicitly accept real-money trading risk, and be aware that a failed second leg may leave an unhedged position that the local budget/cooldown files do not record.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
world_cup_delta_pairs.py:473
Finding

Non-atomic pair execution can create untracked directional exposure

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
clawhub.json:6
Finding

Unbounded dependency version permits unreviewed SDK updates

Content
View full analysis
=0.17.1"] ``` ### Technical Analysis The dependency specification establishes only a minimum version. Any later `simmer-sdk` release satisfies the requirement and may therefore be installed without the Skill’s source code or manifest changing. The SDK is imported inside the trading implementation and receives `SIMMER_API_KEY`: ```python from simmer_sdk import SimmerClient key = os.environ.get("SIMMER_API_KEY") _client = SimmerClient(api_key=key, venue=venue, live=live) ``` It also handles market queries, account positions, market context, and live order placement. Consequently, an unreviewed future SDK version executes with access to sensitive authentication material and trading capabilities. No malicious dependency behavior was observed in the audited project files, and the package name is consistent with the declared service. The risk arises from allowing future, unaudited versions rather than from confirmed typosquatting or dependency confusion. ### Attack Path 1. A future SDK release containing a vulnerability, compromised code, or materially changed behavior is published under the same package name. 2. A new installation resolves `simmer-sdk>=0.17.1` to that release. 3. The Skill imports the updated package without requiring a manifest change. 4. The package receives the Simmer API key and participates in account and trading operations. 5. Depending on the package behavior and API-key permissions, it could disclose the key, alter requests, expose account information, or submit unintended trades. ### Impact Assessment The affected privilege scope is that of the process running the Skill and the permissions granted to `SIMMER_API_KEY`. Potential impact includes: - Disclosure of the Simmer API key. - Unauthorized access to portfolio and ...[truncated 352 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tainted flow: 'req' from os.environ.get (line 125, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · world_cup_delta_pairs.py (reported line 127)May include surrounding context.

python
url = f"https://api.simmer.markets/api/sdk/markets?{params}"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            data = json.loads(r.read().decode())
    except Exception:
        return []

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented behavior describes World Cup market pairing and trading logic, but the analyzed implementation reportedly accesses account portfolio and positions endpoints instead of relevant sports market data and lacks the stated pairing logic. That mismatch is dangerous because users may grant permissions or run the skill under false assumptions, exposing sensitive account data or enabling unintended actions unrelated to the declared strategy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill for pairing NO-advance and YES-winner legs for the same 2026 World Cup team to identify cross-market mispricing. This file instead implements a generic Simmer account status CLI that reads an API key, queries portfolio and positions endpoints, and prints wallet/position information, which is unrelated to constructing or analyzing World Cup pair trades.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable workflows that imply network, file, and environment access, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, missing capability declarations weakens least-privilege enforcement and makes it harder for reviewers or runtime policy to constrain what the skill can access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown explicitly documents live trading and an option to disable safeguards, but it does not include a clear warning that these actions may place real-money trades or bypass protections. In a trading skill, that context makes the omission more dangerous because users may execute impactful commands without understanding the financial and operational risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The inline documentation says the module shows wallet balance, positions, and recent activity, which describes an account-status utility. That directly conflicts with the skill manifest's declared intent to pair NO-advance and YES-winner legs for the same 2026 World Cup team.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

For a skill whose stated purpose is to pair specific World Cup market legs, accessing a bearer API key from the environment and retrieving account portfolio/positions is an additional capability not obviously required by that purpose. The code performs authenticated account introspection rather than market-pair discovery or pricing analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · world_cup_delta_pairs.py (reported line 124)May include surrounding context.

python
"limit": max(1, min(limit, 1000)),
        }
    )
    url = f"https://api.simmer.markets/api/sdk/markets?{params}"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {key}", "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=20) as r:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is presented as a market-pairing/trading helper, but it also performs live order placement and persists spend/cooldown state on disk. In an agent-skill setting, this increases operational risk because invoking the skill can cause real financial actions and durable state changes without a stronger consent boundary than the --live flag. The issue is more dangerous here because the domain is live trading, where unintended execution directly impacts funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

When --live is supplied, the skill submits real orders immediately without an additional execution-time warning or confirmation. In agent environments, a single flag may be set indirectly or persist in automation, so lack of a final user-facing warning materially increases the chance of accidental financial transactions. The trading context raises the severity because the consequence is direct monetary loss rather than a harmless side effect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CLI description labels the strategy as 'delta-neutral,' but the payoff logic is not truly neutral and can lose in scenarios where the team advances but the winner leg does not reprice enough. Mischaracterizing strategy risk is security-relevant in an autonomous trading context because users or orchestration systems may authorize execution under a false assumption of limited directional exposure. The context makes this more dangerous because it can lead to real-money trades based on misleading safety semantics.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

This manifest defines runtime behavior such as autostart and an entrypoint, but it does not describe any invocation phrases, scope limits, or exclusion conditions. For manifest files, missing specificity around activation can make it unclear when the skill should run versus remain inactive.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.