Security audit

Smart Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Polymarket trading template, but its scheduled live mode can repeatedly place real-money trades without built-in exposure limits.

Install only if you are comfortable reviewing and operating an automated trading template. Keep it in dry-run until you add or enforce account-level spending limits, position checks, order deduplication, cooldowns, and pinned dependencies; use a restricted AION_API_KEY and avoid setting RUN_LIVE in shared or inherited environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:5
Finding: Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trade_thesis.py:302
Finding: Scheduled Live Mode Can Repeatedly Place Unbounded Trades
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trade_thesis.py:127
Finding: Missing Market Identifier Is Converted to the Truthy String “None”
Content: View full analysis
str: return str( market.get("id") or market.get("marketId") or market.get("market_id") or market.get("conditionId") or market.get("condition_id") ) ``` The caller expects a missing identifier to be falsy: ```python if not market_id or yes_price is None or no_price is None: decisions.append(f"{title}: SKIP (missing id or price data)") continue ``` ### Technical Analysis If none of the recognized identifier fields is present, the `or` expression evaluates to Python `None`. Calling `str(None)` converts it to the non-empty string `"None"`. Because non-empty strings are truthy, `not market_id` evaluates to `False`, bypassing the intended missing-identifier validation. If the same malformed market record contains valid-looking prices, the script proceeds to call `get_market_context("None", ...)`. If the context response does not produce a skip condition and live mode is enabled, it can subsequently call `trade(market_id="None", ...)`. A robust SDK or remote API may reject this value, but the project cannot safely rely on undocumented downstream validation. The local validation explicitly intends to reject absent IDs and currently fails to do so. ### Attack Path 1. Market discovery returns a record with no `id`, `marketId`, `market_id`, `conditionId`, or `condition_id`. 2. The record still includes parseable YES or NO price information. 3. `get_market_id()` returns the string `"None"`. 4. The missing-data condition treats `"None"` as a valid identifier. 5. The script requests context for the invalid identifier. 6. If no warning is returned and live mode is enabled, the script attempts a real trade using `market_ ...[truncated 592 chars]
Remediation: View remediation
str | None: raw_id = ( market.get("id") or market.get("marketId") or market.get("market_id") or market.get("conditionId") or market.get("condition_id") ) if raw_id is None: return None market_id = str(raw_id).strip() if not market_id or market_id.lower() == "none": return None return market_id ``` Also: - Update the return annotation and callers to handle `None` explicitly. - Validate identifier format and length according to the venue's documented schema. - Fail closed when context retrieval returns malformed or unexpected data. - Add unit tests for absent, null, empty, whitespace-only, and invalid identifiers. - Ensure malformed individual records are skipped without terminating processing of valid markets. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents use of environment-based credentials (AION_API_KEY) and live trading behavior, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can cause the skill to receive broader access than intended, increasing the chance of secret exposure or unauthorized actions if the runtime infers capabilities loosely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The publish command uses npx clawhub@latest, which pulls the latest package version at execution time rather than a fixed, reviewed version. This creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code on the operator's machine during publishing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The install verification step also uses npx clawhub@latest, which fetches and runs whatever version is current at the time of execution. Because npx executes downloaded packages, this exposes users to avoidable supply-chain compromise or unsafe behavioral changes from unreviewed upstream updates.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes a RUN_LIVE environment variable described as enabling live trades without requiring a --live flag, which weakens explicit user consent for financially sensitive actions. Because the skill is an automated trader with a cron schedule, a simple environment misconfiguration or inherited deployment setting could cause real trades to execute without a deliberate per-run opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest schedules the skill to run automatically every 15 minutes and declares a managed entrypoint for a trading bot, but it does not encode meaningful activation constraints, market scope restrictions, spending limits, or fail-safe conditions. In a live-trading context, broad unattended execution materially increases the chance of repeated unwanted trades, runaway loss, or operation under stale/misconfigured thesis inputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.