ClawHub
Back to skill

Security audit

Polymarket

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a sports market-data guide, but it also documents wallet-backed trading and private-key setup without enough upfront disclosure or safety controls.

Review this carefully before installing. Use the read-only market-data commands without a wallet when possible. Do not provide a real private key unless you intentionally want trading enabled, understand that orders can affect funds, and can isolate the dependency and key handling with a limited-purpose wallet.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:58
Finding

Unpinned Third-Party Package Installation Exposes Wallet-Backed Operations to Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:58, SKILL.md:167, references/api.md:5, and scripts/validate_params.sh:8
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippets

SKILL.md:57-58:

bash
pip install sports-skills[polymarket]

SKILL.md:166-167:

text
Solution: Run `pip install sports-skills[polymarket]` and set `POLYMARKET_PRIVATE_KEY` environment variable

references/api.md:5:

markdown
- **py_clob_client** (Python SDK): Trading operations (create/cancel orders, view trades). Requires `pip install sports-skills[polymarket]` and a wallet private key. No CLI binary needed.

scripts/validate_params.sh:6-9:

bash
TRADING_COMMANDS="create_order market_order cancel_order cancel_all_orders get_orders get_user_trades"
if echo "$TRADING_COMMANDS" | grep -qw "$COMMAND"; then
  echo "WARNING: $COMMAND requires py_clob_client and a wallet. Install with: pip install sports-skills[polymarket]. Set POLYMARKET_PRIVATE_KEY=0x... in .env or call configure(private_key=...)."
fi

Technical Analysis

The project repeatedly instructs users to install sports-skills[polymarket] without pinning a reviewed version, verifying package hashes, or providing a dependency lockfile. Consequently, the resolved package and its transitive dependencies may change after this Skill has been reviewed.

Python package installation can execute package-controlled build logic, while installed package code executes with the privileges of the invoking user. The risk is elevated because the documented trading workflow places a wallet private key in POLYMARKET_PRIVATE_KEY or passes it to configure(private_key=...). The implementation that handles that key is not included in the audited project, so its behavior could not be verified.

This finding does not establish that the current package is malicious. It establishes that ...[truncated 1552 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin sports-skills to a specifically reviewed version, for example:
    bash
    python -m pip install 'sports-skills[polymarket]==<reviewed-version>'
  2. Publish a lockfile or constraints file that pins all transitive dependencies.
  3. Require package hash verification using --require-hashes and hashes obtained through a trusted release process.
  4. Document the package's authoritative registry entry, source repository, maintainer identity, and release-signing or provenance information.
  5. Audit the exact sports-skills and py_clob_client versions responsible for private-key handling before recommending wallet-backed operations.
  6. Install and run trading functionality in an isolated virtual environment or container under a non-privileged account.
  7. Avoid exposing a high-value wallet key broadly through the process environment. Use a dedicated, least-privileged trading wallet with limited funds and securely managed credentials.
  8. Add dependency vulnerability and provenance checks to the release process, and require explicit review before updating pinned versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The manifest presents the skill as a no-auth, read-only market-data tool, but the documentation later introduces trading functionality that depends on a wallet private key. This mismatch can mislead operators or downstream agents into enabling higher-risk capabilities than expected, expanding the trust boundary from public data access to credentialed financial actions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/validate_params.sh (reported line 8)May include surrounding context.

sh
# Trading commands need py_clob_client + wallet
TRADING_COMMANDS="create_order market_order cancel_order cancel_all_orders get_orders get_user_trades"
if echo "$TRADING_COMMANDS" | grep -qw "$COMMAND"; then
  echo "WARNING: $COMMAND requires py_clob_client and a wallet. Install with: pip install sports-skills[polymarket]. Set POLYMARKET_PRIVATE_KEY=0x... in .env or call configure(private_key=...)."
fi

# token_id vs market_id warning

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation introduces wallet setup and trading-related installation steps in a skill whose stated purpose is sports market data retrieval. Even without executable code here, this can cause an agent or user to configure sensitive capabilities unnecessarily, increasing the chance of unintended trading enablement or credential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells users to export a private wallet key but provides no warning about the sensitivity of that secret, the risk of account compromise, or the financial consequences of enabling trading commands. In an agent environment, normalizing inline private key configuration can lead to secrets being pasted into unsafe contexts, stored in shell history, or exposed through logs and prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is described and intended as a read-only sports odds/prediction-market integration, but the reference explicitly exposes wallet configuration and live trading operations such as order placement and cancellation. This creates a dangerous capability mismatch: an agent or downstream integrator could invoke financially impactful actions in a context where users reasonably expect informational queries only, increasing the risk of unauthorized trading or key-handling misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation lists commands for configuring a wallet, placing market and limit orders, and cancelling orders without any warning that these actions can move funds, create irreversible market exposure, or require sensitive private-key material. In an agent setting, omission of such warnings lowers operator caution and makes accidental or socially engineered execution of financial actions more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The reference documentation explicitly mentions trading operations such as creating and canceling orders and use of a wallet private key, which expands the apparent capability of the skill beyond its stated read-only sports odds and market data purpose. In an agent setting, this creates a dangerous mismatch: downstream developers or orchestration logic may enable code paths or dependencies that permit financial actions, increasing the risk of unauthorized trading or secret handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Introducing authenticated order-placement capability is not justified by the declared use case and materially increases risk because it normalizes wallet private key usage inside a sports market information skill. Even if no trading code is present in this file, documentation that encourages authenticated operations can lead integrators to add privileged functionality, exposing users to unauthorized market orders, financial loss, and credential compromise.

Content

No source excerpt is available for this finding.