T05 · Unauthorized Access and Privilege Escalation
Error
- Location
resolution_tracker.py:28- Finding
Overbroad Loading of Secrets from the User Home Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Simmer Resolution Tracker
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it automates wallet-affecting redemptions with broad credential exposure and weak safety boundaries, so it needs careful review before installation.
Only install this in an isolated environment with a dedicated low-balance wallet and narrowly scoped API key. Prefer POLY_MODE=sim first, avoid storing unrelated secrets in ~/.env, pin and review simmer-sdk before use, and confirm that cron, DATA_DIR, and DISCORD_WEBHOOK are configured exactly as intended.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
resolution_tracker.py:94- Finding
Unrestricted Webhook Destination Can Receive Private Trading Information
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
clawhub.json:3- Finding
Unpinned Third-Party SDK Executes in a Wallet-Privileged Process
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)
Tainted flow: 'req' from os.environ.get (line 100, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python body = json.dumps(data).encode() if data else None req = urllib.request.Request(url, headers=headers, method=method, data=body) try: with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: print(f" API error {e.code}: {e.read().decode()[:120]}")
Tainted flow: 'req' from os.environ.get (line 100, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/json"}, method="POST", ) urllib.request.urlopen(req, timeout=10) except Exception as e: print(f" ⚠️ Webhook error: {e}")
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Automatically loading .env files constitutes credential access because the script reads potentially sensitive secrets from local developer or home directories. In this skill context, that behavior is not strictly necessary for resolution tracking and can unintentionally consume secrets unrelated to the application, increasing exposure and making behavior dependent on ambient credentials.
- Content
python from datetime import datetime, timezone from pathlib import Path # ── Load .env if present (development convenience) ──────────────────────────── def _load_env(): for candidate in [".env", os.path.expanduser("~/.env")]: if os.path.exists(candidate):
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The specific inclusion of ~/.env broadens the blast radius from project-local configuration to the user's general secret store, which is especially sensitive. A cron-executed trading skill should not implicitly harvest secrets from a home-directory file because it can ingest unrelated credentials and create hard-to-audit secret dependencies.
- Content
python # ── Load .env if present (development convenience) ──────────────────────────── def _load_env(): for candidate in [".env", os.path.expanduser("~/.env")]: if os.path.exists(candidate): with open(candidate) as f: for line in f:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes capabilities that can access environment secrets, read/write local data, use the network, and execute shell-adjacent setup/run commands, yet it declares no explicit tool scope or permission boundaries. In a skill that handles API keys, a wallet private key, journal files, Discord webhooks, and on-chain redemption flows, missing scope declarations materially increases the risk of over-privileged execution and unintended secret exposure or asset-affecting actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill prominently advertises that it will automatically redeem winning positions on-chain and update a trade journal every 5 minutes, but it does not present a strong upfront warning that it will modify financial assets and local data. Because these actions are autonomous and recurring, a user could enable the skill without fully appreciating that it can trigger irreversible blockchain transactions and alter records.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup instructions ask the user to export a wallet private key directly into an environment variable without any security warning or handling guidance. In the context of an automated trading skill that performs on-chain redemptions, compromise or mishandling of this key could lead to direct theft or unauthorized movement of funds, making the omission especially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module documentation states that a wallet private key is required for redemptions, but it does not provide a prominent user-facing warning about secure storage, least privilege, or the consequences of live mode. In a trading automation context, weak credential-handling guidance materially increases the chance of unsafe deployment practices.
- Content
Tainted flow: 'tmp' from os.environ.get (line 179, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 88% confidence
- Finding
JOURNAL_PATH is derived from DATA_DIR, which is environment-controlled, and the code writes to tmp files without constraining the destination to a safe base directory. If an attacker can influence DATA_DIR, they can cause the skill to overwrite arbitrary writable files via direct path control and the later os.replace call.
- Content
python def save_journal(trades): tmp = JOURNAL_PATH + ".tmp" Path(tmp).parent.mkdir(parents=True, exist_ok=True) with open(tmp, "w") as f: for t in trades: f.write(json.dumps(t) + "\n") os.replace(tmp, JOURNAL_PATH)
Tainted flow: 'RESOLVED_PATH' from os.environ.get (line 56, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 88% confidence
- Finding
RESOLVED_PATH is also derived from the environment-controlled DATA_DIR and is opened for append with no path validation. In environments where attackers can affect configuration, this enables unauthorized file creation or modification in arbitrary writable locations.
- Content
python return except Exception: pass with open(RESOLVED_PATH, "a") as f: f.write(json.dumps(trade) + "\n")
Tainted flow: '_COOLDOWN_PATH' from os.environ.get (line 223, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 86% confidence
- Finding
_COOLDOWN_PATH is built from DATA_DIR and then written without validating the path. As with the other state files, hostile control of DATA_DIR can redirect writes to unintended filesystem locations and tamper with local files accessible to the process.
- Content
python s["consecutive_losses"] = 0 else: s["consecutive_losses"] = s.get("consecutive_losses", 0) + 1 with open(_COOLDOWN_PATH, "w") as f: json.dump(state, f, indent=2) except Exception as e: print(f" ⚠️ Cooldown update error: {e}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
In live mode, the script automatically performs on-chain redemption transactions without an explicit per-run confirmation or strong runtime warning. Because this skill directly manages trading outcomes and may be scheduled via cron, silent autonomous transaction execution increases the risk of unintended financial actions if configuration is wrong or the operator misunderstands the mode.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description says it monitors resolutions and auto-redeems winning positions, but the code also performs a portfolio-wide sweep for any redeemable positions not yet claimed. That expands operational scope beyond newly resolved positions and can trigger additional on-chain actions the operator may not expect from the manifest.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill reads .env files from the current directory and the user's home directory, which is broader credential access than needed for a cron-style resolution tracker. In a sensitive workstation or shared environment, this can ingest unrelated secrets and silently alter runtime behavior based on ambient developer files.
- Content
Static analysis
No suspicious patterns detected.