ClawHub
Back to skill

Security audit

Market Configurable Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is contract-call documentation for a crypto prediction market; it is not malware, but the write calls it describes can move funds.

Installers should treat any generated write call from this skill as a real financial transaction: verify the network, contract address, token, amount, fee recipient, and slippage settings, use explicit user confirmation before signing, prefer testnets for trials, and correct the Chinese startTime/endTime wording before relying on that section for oracle logic.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown file includes examples and guidance for `createMarket`, `buyYes`, `buyNo`, `swapYesForNo`, `swapNoForYes`, `redeem`, and `resolve`, all of which are blockchain write operations that can spend assets, create markets, or trigger settlement. Although the file explains how to call them, it does not clearly warn users that these actions submit real transactions, may incur fees, and can be irreversible once confirmed.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The Chinese documentation for `getAveragePriceFromUniswapV3` appears to invert the parameter relationship (`startTime > endTime`) while the English text and function semantics require `startTime < endTime`. In a skill that guides on-chain settlement/oracle interactions, contradictory call semantics can cause integrators to build incorrect checks, mis-handle failures, or misunderstand how settlement prices are derived.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The front matter sets `language: en`, and later a second metadata block sets `language: zh-CN`, which reflects a hard-coded locale choice rather than an explicit user-selectable option. The file does not state that language is chosen based on user preference or that the locale restriction is justified, so it can be interpreted as forcing a specific language/locale.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The duplicated front matter near the end of the file sets `language: zh-CN`, again presenting a fixed locale choice in natural-language metadata. Because the skill content is bilingual but the metadata does not describe user choice or regional necessity, this may violate the locale-choice policy.

Static analysis

No suspicious patterns detected.