ClawHub
Back to skill

Security audit

Alphagbm Polymarket

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed finance-analysis skill with no executable code, persistence, credential access, or hidden behavior, but users should treat its trading outputs cautiously.

Install only if you want speculative market-analysis assistance. Treat any suggested trades as informational research, verify data and assumptions independently, and remember that options and event-driven trades can lose money quickly.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly frames probability gaps as tradeable mispricings and encourages users to act on them, but it provides no financial-risk disclaimer or statement that outputs are informational rather than investment advice. In a finance context, presenting actionable trading signals without warnings can materially influence user decisions and expose users to loss, especially when probabilities, model assumptions, or market mappings are wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented outputs include 'suggested options trades' and 'actionable mispricing opportunities' without any warning about leverage, option-specific downside, or the possibility that inferred event-to-options relationships are unreliable. Because options trading can rapidly impact user assets, omitting safety framing increases the chance that users treat generated suggestions as trustworthy execution guidance rather than speculative analysis.

Content

No source excerpt is available for this finding.