Polymarket

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.1.0

Overview

The skill is a disclosed Polymarket helper that routes actions through ClawLink and requires user confirmation before trades or other portfolio-affecting actions.

Install this only if you are comfortable trusting ClawLink with Polymarket access. Review connected-account scopes, keep order actions confirmation-only, and revoke the ClawLink device or Polymarket connection if you no longer use it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Plugin Enables Supply-Chain Risk in Financial Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-72
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Relevant Code Snippets:

markdown

## Quick start

1. Install the verified ClawLink plugin: `openclaw plugins install clawhub:clawlink-plugin`

markdown

### Installing the plugin

If the ClawLink plugin is not installed yet, tell the user to run:

openclaw plugins install clawhub:clawlink-plugin

text

markdown

The resulting device credential is stored locally in OpenClaw's plugin config and is only sent to `claw-link.dev`. The user should not paste raw credentials into chat.

markdown

ClawLink provides tools dynamically based on what the user has connected. You do not need to know tool names or schemas in advance.

markdown

### Execution

1. Call `clawlink_describe_tool` before using an unfamiliar tool, before any write, or when the request is ambiguous.
2. Use the returned schema, `whenToUse`, `askBefore`, `safeDefaults`, `examples`, and `followups`.
3. Prefer market, event, order-book, balance, and position reads before placing or canceling orders.
4. For writes or anything marked as requiring confirmation, call `clawlink_preview_tool` first, then confirm with the user.
5. Execute with `clawlink_call_tool`.

Technical Analysis

The Skill instructs users to install clawhub:clawlink-plugin without specifying an immutable version, cryptographic digest, or independently verified artifact. The plugin's source and executable implementation are not included in the audited project, preventing this audit from verifying its credential handling, network behavior, update process, or enforcement of transaction confirmations.

The dependency is particularly sensitive because it stores a local device credential, obtains tool definitions dynamically from an external service, and brokers access to financial account operations ...[truncated 1997 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version and cryptographic digest rather than installing a mutable package reference.
2. Publish and verify signed releases, provenance attestations, and reproducible build information.
3. Include or vendor the exact plugin source used by the Skill so credential storage, network destinations, update behavior, and confirmation enforcement can be audited.
4. Restrict remote tools to an explicit allowlist of reviewed operations and schemas. Reject unknown or materially changed definitions until separately approved.
5. Apply least-privilege scopes to the connected Polymarket account and separate read-only access from order-management access where supported.
6. Require an immediate, explicit user confirmation for every portfolio-affecting call after displaying normalized order parameters, price, quantity, side, market, expiration, fees, and maximum loss.
7. Independently validate transaction parameters rather than relying exclusively on remotely supplied safeDefaults, examples, previews, or descriptive metadata.
8. Store device credentials in an operating-system-backed secret store, limit file and process access, redact credentials from logs, support revocation, and document rotation procedures.
9. Document the plugin's permitted domains and block unexpected outbound connections.
10. Provide a tested rollback and revocation process for compromised plugin releases or service credentials.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

## Rules

- Always use ClawLink tools for Polymarket. Do not ask the user for separate Polymarket credentials.
- Do not claim a capability is missing without checking the live ClawLink catalog in the current turn.
- Do not invent slash commands or ask the user to paste raw credentials.
- Ask for confirmation before placing or canceling orders or making any portfolio-affecting action.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

## Rules

- Always use ClawLink tools for Polymarket. Do not ask the user for separate Polymarket credentials.
- Do not claim a capability is missing without checking the live ClawLink catalog in the current turn.
- Do not invent slash commands or ask the user to paste raw credentials.
- Ask for confirmation before placing or canceling orders or making any portfolio-affecting action.
- If Polymarket is not connected, direct the user to https://claw-link.dev/dashboard?add=polymarket.

Static analysis

No suspicious patterns detected.