Prediction Market Arbitrage

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:10 PM UTC
• Version: 1.0.0

Overview

This is a coherent trading-alert orchestration skill, but its setup uses mutable remote installs and a broad update command that can change unrelated installed skills.

Review the install steps before using this skill. Prefer pinned ClawHub and skill versions, avoid `update --all`, and run installation without trading credentials such as `SIMMER_API_KEY` in the environment. Treat any execution-plan output as manual guidance only and require a dry run plus explicit confirmation before live trading.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29

Finding

Unpinned Remote Dependency Execution and Broad Dependency Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-41
Vulnerability Type: Supply-chain risk through mutable remote packages and unscoped updates
Risk Level: High

Vulnerable Code

bash

Install/refresh with ClawHub:

npx -y clawhub@latest install topic-monitor
npx -y clawhub@latest install polymarket-odds
npx -y clawhub@latest install simmer-weather
npx -y clawhub@latest update --all

Verify:

npx -y clawhub@latest list

Technical Analysis

The instructions use npx -y clawhub@latest, which can download and execute the current registry version of the clawhub package without pinning it to the version that was reviewed. The -y option suppresses interactive confirmation, while @latest allows the executed implementation to change after this Skill has been audited.

The three installed Skills are also requested without exact version constraints, even though SKILL.md identifies specific inspected versions (topic-monitor 1.3.4, polymarket-odds 1.0.0, and simmer-weather 1.7.1). Consequently, the installed code is not guaranteed to match the reviewed versions.

The update --all command further exceeds the minimum dependency-management scope required by this Skill. It can modify unrelated locally installed Skills rather than updating only the three declared dependencies. This enlarges the supply-chain attack surface and may unexpectedly change other agent functionality.

Attack Path

1. An attacker compromises the package registry account, distribution channel, or a future release of clawhub or one of the named Skills.
2. The compromised release becomes the version resolved by @latest or by an unversioned Skill installation.
3. A user follows the documented installation or verification commands.
4. npx downloads and executes the changed clawhub package with the invoking user's privileges.
5. The installer installs changed upstream Skill code, or update --all re ...[truncated 1267 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to an exact reviewed version instead of using @latest, for example:

   bash

   npx -y clawhub@<reviewed-version> ...
   

2. Pin each upstream Skill to the exact inspected version:
   • topic-monitor 1.3.4
   • polymarket-odds 1.0.0
   • simmer-weather 1.7.1
3. Verify package integrity using trusted checksums, lockfiles, signatures, or registry provenance before execution.
4. Remove update --all. Update only explicitly named dependencies after reviewing their release contents and integrity metadata.
5. Avoid automatic confirmation with -y where practical so users can review package-resolution details before remote code executes.
6. Run installation and dependency inspection in a sandbox or least-privileged environment without trading credentials in the process environment.
7. Expose SIMMER_API_KEY only to the specific execution process that requires it, rather than to installation, update, market-query, or monitoring commands.
8. Re-audit upstream Skills whenever their pinned versions change.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx -y clawhub@latest install ..., which pulls and executes the latest package version at runtime rather than a reviewed, pinned release. In a security-sensitive workflow that coordinates trading-related tooling, this creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code on the user's machine during installation or update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This line repeats installation through npx using the latest clawhub release, which means the executed package can change over time without review. Because npx executes downloaded package code, an attacker who compromises the package or publishing account could gain code execution during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command on this line also invokes an unpinned clawhub@latest, exposing users to non-deterministic code execution from the npm ecosystem. In practice, this undermines reproducibility and opens the door to supply-chain compromise during installation of one of the dependent skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx -y clawhub@latest update --all is especially risky because it both executes an unpinned package and updates all installed skills, multiplying blast radius if the package or fetched skills are compromised. In a meta-skill that influences trading decisions and references API-backed execution patterns, broad unreviewed updates increase the chance of arbitrary code execution or silent behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Even the verification step uses npx -y clawhub@latest list, which still executes whatever code is currently published as the latest package version. Although read-only in intent, it preserves the same supply-chain execution risk and normalizes unsafe package execution practices throughout the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prescribed alert message is written in German and presented as the required emitted output, but the skill does not ask the user to choose a language or document a justified locale constraint. This creates a language-policy violation because it implicitly forces a specific language on all users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.