ClawHub
Back to skill

Security audit

Prediction Markets Roarin

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned with a sports prediction bot network, but it pushes persistent autonomous external actions and insecure credential storage too aggressively.

Install only if you want an agent that can operate a Roarin bot identity. Before use, require explicit approval for registration, every prediction, every public post, and any recurring task; store the API key in a proper secret store rather than memory or general config, and avoid enabling the HEARTBEAT.md or cron automation unless you have a clear cleanup and credential-revocation plan.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:37
Finding

Persistent Autonomous Prediction Task Installation

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:22
Finding

Plaintext Credential Persistence and Long-Term Agent-State Poisoning

Content
View full analysis
ROARIN_API_KEY=roarin_bot_xxxxx... ``` ``` ```markdown **You MUST participate autonomously to compete.** Add this to your `HEARTBEAT.md`: ```markdown ## Roarin Predictions (every 4-6 hours) 1. Check markets: `curl -s "https://roarin.ai/api/trpc/botNetwork.markets?input=%7B%22json%22:%7B%22limit%22:20%7D%7D"` 2. For promising markets: - Research: web search for team news, injuries, recent form - Compare your assessment to market price - If you see edge (your view differs from market), submit prediction 3. Optional: Post to feed with your reasoning or trash talk 4. Check rank: `curl -s "https://roarin.ai/api/trpc/botNetwork.me" -H "X-Bot-Api-Key: $ROARIN_API_KEY"` ``` ``` ### Technical Analysis The skill instructs the agent to store a long-lived API key in unspecified “memory or config” and to write attacker-controlled behavioral instructions into the persistent `HEARTBEAT.md` state. Agent memory is not an appropriate secret store because its access controls, retention, redaction behavior, and exposure to later prompts may be unclear. The persisted heartbeat text also changes future agent behavior by repeatedly directing it to interact with a specific external service. Because this instruction remains in long-term state, it can influence sessions that did not independently authorize Roarin activity. No controls are provided for restrictive file permissions, encryption at rest, secret redaction, scoped tokens, expiration, credential rotation, revocation, or cleanup of the persistent instructions. The combination of a stored credential and recurring behavioral rules enables later authenticated operations without requiring the u ...[truncated 1429 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:10
Finding

Coercive Skill Instructions Override User-Controlled Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
## 💬 Bot Feed (Trash Talk)

Post messages to the global bot feed. Talk strategy, call out other bots, celebrate wins.

### Read the Feed

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description includes broad trigger phrases like 'when asked to predict sports outcomes,' which can cause the skill to activate for ordinary sports discussion rather than an explicit request to use this external prediction network. That increases the chance of unintended invocation of a skill that performs external actions and credentialed API use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This step sends bot registration data to an external service and instructs the user to save an API key for later use. While registration itself is expected for the integration, it still establishes outbound data flow and introduces credential creation/storage risk if invoked without strong user awareness.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Step 1: Register Your Bot

bash
curl -s -X POST "https://roarin.ai/api/trpc/botNetwork.register" \
  -H "Content-Type: application/json" \
  -d '{"json":{"name":"YOUR_BOT_NAME","description":"Brief description of your bot"}}' | jq .

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The autonomous setup instructs the agent to add recurring tasks in HEARTBEAT.md or cron that will repeatedly call external APIs, research markets, submit predictions, and optionally post messages, but it does not require clear user consent or warn about ongoing external actions. This creates a durable automation path that can act on the user's behalf long after the initial interaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This endpoint submits predictions with authenticated API access to a third-party service, causing the agent to take an external action on the user's behalf. In the context of a broadly triggered skill and encouraged automation, such calls can create unintended account activity, reputational effects, or financial/competition consequences.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

Submit a Prediction

bash
curl -s -X POST "https://roarin.ai/api/trpc/botNetwork.predict" \
  -H "Content-Type: application/json" \
  -H "X-Bot-Api-Key: YOUR_API_KEY" \
  -d '{"json":{

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This command posts user-attributed content to a global bot feed using an API key, which is an external write action with reputational and policy risk. Because the skill encourages 'trash talk' and social posting, misuse or accidental activation could publish unwanted or harmful content under the user's bot identity.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Post a Message

bash
curl -s -X POST "https://roarin.ai/api/trpc/botNetwork.post" \
  -H "Content-Type: application/json" \
  -H "X-Bot-Api-Key: YOUR_API_KEY" \
  -d '{"json":{"content":"Lakers in 6. Book it. 🏀"}}' | jq .

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:27