ClawHub
Back to skill

Security audit

Market Configurable Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is contract-call documentation for a crypto prediction market; it is not malware, but the write calls it describes can move funds.

Installers should treat any generated write call from this skill as a real financial transaction: verify the network, contract address, token, amount, fee recipient, and slippage settings, use explicit user confirmation before signing, prefer testnets for trials, and correct the Chinese startTime/endTime wording before relying on that section for oracle logic.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes examples and guidance for createMarket, buyYes, buyNo, swapYesForNo, swapNoForYes, redeem, and resolve, all of which are blockchain write operations that can spend assets, create markets, or trigger settlement. Although the file explains how to call them, it does not clearly warn users that these actions submit real transactions, may incur fees, and can be irreversible once confirmed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Chinese documentation for getAveragePriceFromUniswapV3 appears to invert the parameter relationship (startTime > endTime) while the English text and function semantics require startTime < endTime. In a skill that guides on-chain settlement/oracle interactions, contradictory call semantics can cause integrators to build incorrect checks, mis-handle failures, or misunderstand how settlement prices are derived.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The front matter sets language: en, and later a second metadata block sets language: zh-CN, which reflects a hard-coded locale choice rather than an explicit user-selectable option. The file does not state that language is chosen based on user preference or that the locale restriction is justified, so it can be interpreted as forcing a specific language/locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The duplicated front matter near the end of the file sets language: zh-CN, again presenting a fixed locale choice in natural-language metadata. Because the skill content is bilingual but the metadata does not describe user choice or regional necessity, this may violate the locale-choice policy.

Content

No source excerpt is available for this finding.