ClawHub
Back to skill

Security audit

Polymarket Arbitrage Cn

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Polymarket monitoring, but its monitor script can execute shell-injected commands through user-controlled paths and can expose webhook tokens in logs.

Review before installing. Run it only in a constrained environment, do not pass untrusted values to --data-dir or other monitor parameters, avoid using real Telegram bot tokens on the command line, and prefer a fixed virtual environment with pinned dependencies. This skill does not appear to place trades or manage wallet keys, but its monitor script should be fixed before routine use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/monitor.py:30
Finding

OS Command Injection Through User-Controlled Data Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/monitor.py:103
Finding

Webhook Credential Exposure Through Command-Line Arguments and Logging

Content
View full analysis
/sendMessage?chat_id=" ``` The monitor then writes the full supplied webhook URL to standard error: ```python def send_alert(arb, webhook_url=None): """Send alert for arbitrage opportunity.""" message = f""" 🚨 ARBITRAGE OPPORTUNITY DETECTED {arb['title'][:80]} Type: {arb['type']} Net Profit: {arb['net_profit_pct']:.2f}% (after fees) Volume: ${arb['volume']:,} Risk Score: {arb['risk_score']}/100 Action: {arb['action']} URL: {arb['url']} Probabilities: {arb['probabilities']} Sum: {arb['prob_sum']}% """ print(message, file=sys.stderr) # TODO: Implement webhook alerts (Telegram, Discord, etc.) if webhook_url: print(f"[ALERT] Would send to webhook: {webhook_url}", file=sys.stderr) ``` ### Technical Analysis Telegram webhook URLs commonly contain the bot token as part of the URL path. Passing such a URL through `--alert-webhook` exposes the token in the process argument vector. Depending on the host configuration, command-line arguments may be visible through process-monitoring tools, diagnostic systems, orchestration interfaces, audit records, or shell history. The code compounds this exposure by printing the entire URL to standard error. Standard error is frequently redirected to persistent terminal recordings, service logs, CI logs, or centralized logging systems. Anyone with access to those records may recover the token. The documentation describes webhook alerting as a feature, but the implementation does not perform a network request. It only logs the supplied URL. Thus, c ...[truncated 1451 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:17
Finding

Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior claims automatic arbitrage discovery, but the skill text itself mainly describes scraping, monitoring, and writing output files while key detection behavior is deferred to scripts not shown here. This mismatch can mislead operators about what the skill actually does and hide data-handling or execution side effects that should be explicitly disclosed.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This is a true tool-parameter abuse issue because the subprocess invocation delegates parsing to the shell while incorporating variable content into the command string. In an agent skill context, parameters may come from user prompts, orchestration layers, or filesystem paths, making exploitation more realistic and enabling arbitrary local command execution under the agent's privileges.

Content

Scanner excerpt · scripts/monitor.py (reported line 30)May include surrounding context.

python
print(f"[{datetime.now().strftime('%H:%M:%S')}] {description}", file=sys.stderr)
    
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of shell commands, network access, and local file writes, but it does not declare any tool scope or permissions. That makes the operational capabilities broader and less auditable than the metadata suggests, increasing the chance that an agent or user invokes networked/scripted behavior without clear consent boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include very broad terms like 'Polymarket', '预测市场', '套利', and 'arbitrage', which can activate the skill during ordinary discussion rather than explicit user intent to run monitoring or trading-related workflows. Overbroad activation raises the risk of unintended execution of shell/network instructions in contexts where the user only wanted information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation encourages sending alerts to a Telegram webhook but does not prominently disclose that opportunity data and potentially market-monitoring metadata will be transmitted to a third-party service. Users may expose trading signals, chat identifiers, and bot tokens without understanding the privacy and operational risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The Telegram API endpoint is an external transmission sink, and using it can send monitored opportunity data off-platform to a third party. Even if intended for user alerts, this creates confidentiality and token-exposure risk if messages, URLs, or logs are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

Pass webhook URL to monitor script for alerts:

bash
python scripts/monitor.py --alert-webhook "https://api.telegram.org/bot<token>/sendMessage?chat_id=<id>"

Position Sizing

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The helper executes a string command with shell=True, which allows shell metacharacter interpretation if any part of the command string becomes attacker-controlled. In this file, command strings are built using runtime values such as script paths, output paths, and CLI parameters like min_edge/data_dir, so a crafted value can lead to command injection and arbitrary command execution.

Content

Scanner excerpt · scripts/monitor.py (reported line 30)May include surrounding context.

python
print(f"[{datetime.now().strftime('%H:%M:%S')}] {description}", file=sys.stderr)
    
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

Static analysis

No suspicious patterns detected.