ClawHub
Back to skill

Security audit

Polymarket Btc Momentum

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Bitcoin trading automation, but live mode can place real-money trades with weak market validation and fail-open safety checks.

Review this carefully before installing. Use only a dedicated, low-limit, revocable Simmer API key; keep dry-run mode unless you have audited the code; pin dependencies; and require fail-closed safety checks plus stronger market identification before enabling live trading.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:3
Finding

Unpinned Third-Party SDK Is Entrusted with a Sensitive API Credential

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
btc_momentum.py:198
Finding

Live Trading Proceeds When the Safety-Context Check Fails

Content
View full analysis
0.15: print(f"⛔ Slippage too high ({slippage:.1%}). Aborting.") return if warnings: print(f" ⚠️ Warnings: {warnings}") else: print(" ✅ No blocking warnings.") except Exception as e: print(f" ⚠️ Context check failed: {e} — proceeding anyway.") ``` After this exception handler, execution continues to the trade operation when live mode is enabled. ### Technical Analysis The context request is intended to enforce safety checks for severe flip-flop warnings and excessive slippage. Any exception raised while requesting or parsing that context is caught by a broad `except Exception` handler. Rather than aborting, the handler explicitly proceeds. This creates a fail-open control: the conditions under which the application has the least reliable safety information are treated as authorization to continue. Possible triggers include network failures, timeouts, SDK exceptions, malformed responses, schema changes, missing fields with unexpected types, and service outages. Because `run(live=True)` subsequently invokes `get_client().trade(...)`, this behavior can affect real funds. The default dry-run mode reduces accidental exposure but does not protect executions ex ...[truncated 1158 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
btc_momentum.py:127
Finding

Market Selection Does Not Enforce the Declared Five-Minute and Next-Market Constraints

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented purpose understates the operational risk: the skill can execute live trades, relies on an undeclared CLI trigger, and may trade markets that are broader than the claimed 5-minute sprint scope. For a financial trading agent, this mismatch can cause users or orchestrators to invoke the skill under false assumptions, leading to unintended real-money trades or trading in the wrong market.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable behavior that requires environment access and outbound network access, but it does not declare any tool scope or permissions boundaries. In a trading skill, this omission is dangerous because it obscures the capability to reach external services and use secrets, preventing reviewers and runtime policy from accurately constraining what the skill can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The usage section tells users how to enable live trading but omits a clear warning that --live can place real-money financial bets. In this context, lack of a prominent risk disclosure increases the chance of accidental activation and uninformed use, especially because the skill is framed as a simple template with 'plumbing' already handled.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · btc_momentum.py (reported line 40)May include surrounding context.

python
# ── BTC signal ────────────────────────────────────────────────────────────────

def get_binance_klines(symbol="BTCUSDT", interval="1m", limit=15):
    url = "https://api.binance.com/api/v3/klines"
    params = {"symbol": symbol, "interval": interval, "limit": limit}
    resp = requests.get(url, params=params, timeout=10)
    resp.raise_for_status()