ClawHub
Back to skill

Security audit

Polymarket Sol Momentum

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed automated prediction-market trading skill, but it needs review because it can run live on a schedule and may continue trading when its safety context checks fail.

Install only if you are comfortable with an automated trading strategy that can run every 15 minutes and place live trades through your Simmer key. Keep TRADING_VENUE on sim until tested, set strict Simmer account limits, use a limited-purpose credential, and review or fix the fail-open context-check behavior before allowing real-money venues.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:3
Finding

Security-Sensitive Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation
requests== ``` 2. Generate a lock file containing cryptographic hashes and require hash verification during installation, such as with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Obtain packages only from an explicitly configured, trusted index or an internally controlled package mirror. 4. Review transitive dependencies and retain a software bill of materials for deployed versions. 5. Run dependency vulnerability and provenance checks in CI before publishing the Skill. 6. Test and approve upgrades before changing the lock file rather than automatically consuming the latest releases. 7. Restrict the runtime credential to the minimum account, venue, balance, and trade permissions required by the Skill. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
strategy.py:257
Finding

Live Trading Proceeds When Mandatory Safety Context Checks Fail

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill explicitly requires environment access for SIMMER_API_KEY and network access for CoinGecko, Simmer, and likely market APIs, but it does not declare any permissions or allowed-tools scope. In an agent platform, undeclared capabilities weaken least-privilege controls and can allow broader-than-expected execution, making secret access and outbound requests insufficiently governed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · strategy.py (reported line 56)May include surrounding context.

python
"crypto": "bitcoin",  # fallback: use BTC as market proxy
}

COINGECKO_URL = "https://api.coingecko.com/api/v3/simple/price"

# ── Helpers ──────────────────────────────────────────────────────────────────

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script places real trades whenever --live is supplied, with no final confirmation prompt, no second-factor style acknowledgement, and no per-trade approval at the execution point. In a trading skill, this increases the chance of accidental financial loss from operator error, automation misuse, or running the skill in an unintended environment with live credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.