ClawHub
Back to skill

Security audit

Polymarket

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only Polymarket lookup helper that queries public Polymarket APIs and does not show credential use, persistence, or destructive behavior.

Install this if you are comfortable with Polymarket lookup parameters being used to query Polymarket over the network. The skill appears read-only and does not require Polymarket credentials, but market probabilities and odds should be treated as informational data, not financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This code file performs HTTP requests to external services via urllib, which transmits user-supplied query terms and request metadata off-system. Although the module docstring says it queries public APIs, the executable paths themselves provide no runtime notice, confirmation, or explicit user-facing disclosure when network access occurs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.