ClawHub
Back to skill

Security audit

PredictMe - AI Trading Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparently aimed at PredictMe trading, but it can register an agent, store an API key, and place repeated account-affecting bets without a consistently enforced approval gate.

Review this before installing if you do not want an agent to autonomously register with PredictMe, store a bearer API key, or place repeated TEST/BONUS bets. Use a keychain or locked-down file permissions, require explicit approval before each bet until you intentionally disable it, set conservative bet limits and stop-losses, and remember that commentary/profile activity may be public on PredictMe.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:70
Finding

Bearer API Key Stored in an Insufficiently Protected Plaintext File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared purpose is about trading crypto prediction markets, but the supplied code does not implement trading logic, market interaction, order placement, prediction functionality, wallet use, or any PredictMe-specific market operations. Instead, it purely provides PWA/service-worker caching behavior for static assets and navigation requests. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill explicitly directs the agent to access and persist an API key in credentials.json, creating a sensitive credential access and storage pattern. If that file is exposed, logged, synced, or left with permissive permissions, an attacker could take over the agent's account actions and place unauthorized trades.

Content

Scanner excerpt · skill.md (reported line 75)May include surrounding context.

Save credentials automatically. Never ask the owner to copy-paste.

json
// ~/.predictme/credentials.json (or project-local, add to .gitignore!)
{
  "apiKey": "pm_agent_xxxxx",
  "agentId": "your-agent-id",

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · social/claw-poster.svg (reported line 100)May include surrounding context.

text
</text>
    </g>

    <!-- Tagline -->
    <text x="0" y="150" text-anchor="middle" font-family="Inter, -apple-system, BlinkMacSystemFont, sans-serif" font-size="28" font-weight="400" fill="#e0e0e0" letter-spacing="2">
      Grab the Future. Predict. Win.
    </text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · social/x-poster.svg (reported line 128)May include surrounding context.

text
</text>
    </g>

    <!-- Tagline -->
    <text x="0" y="150" text-anchor="middle" font-family="Inter, -apple-system, BlinkMacSystemFont, sans-serif" font-size="28" font-weight="400" fill="#e0e0e0" letter-spacing="2">
      Grab the Future. Predict. Win.
    </text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · social/claw-poster.svg (reported line 3)May include surrounding context.

text
<svg width="1200" height="675" viewBox="0 0 1200 675" fill="none" xmlns="http://www.w3.org/2000/svg">
  <defs>
    <!-- Background gradient -->
    <linearGradient id="bg-gradient" x1="0%" y1="0%" x2="100%" y2="100%">
      <stop offset="0%" stop-color="#0a0b0f"/>
      <stop offset="50%" stop-color="#0f1115"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · social/x-poster.svg (reported line 3)May include surrounding context.

text
<svg width="1200" height="675" viewBox="0 0 1200 675" fill="none" xmlns="http://www.w3.org/2000/svg">
  <defs>
    <!-- Background gradient -->
    <linearGradient id="bg-gradient" x1="0%" y1="0%" x2="100%" y2="100%">
      <stop offset="0%" stop-color="#0a0b0f"/>
      <stop offset="50%" stop-color="#0f1115"/>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes an autonomous trading API for real-time prediction markets but does not define meaningful trigger constraints, approval gates, or mandatory safety checks before placing bets. In an agent framework, this broad scope can enable continuous high-frequency wagering, increasing the risk of uncontrolled financial actions, policy bypass through autonomous execution, and operation outside an owner's intended limits.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · agent-card.json (reported line 14)May include surrounding context.

json
description: Trade 10-second crypto prediction markets on PredictMe
version: 1.3.0
author: PredictMe
apiBase: https://api.predictme.me/api/v1/agent
agentsJson: https://app.predictme.me/agents.json
metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llms.txt (reported line 18)May include surrounding context.

text
description: Trade 10-second crypto prediction markets on PredictMe
version: 1.3.0
author: PredictMe
apiBase: https://api.predictme.me/api/v1/agent
agentsJson: https://app.predictme.me/agents.json
metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 6)May include surrounding context.

md
description: Trade 10-second crypto prediction markets on PredictMe
version: 1.3.0
author: PredictMe
apiBase: https://api.predictme.me/api/v1/agent
agentsJson: https://app.predictme.me/agents.json
metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 265)May include surrounding context.

md
description: Trade 10-second crypto prediction markets on PredictMe
version: 1.3.0
author: PredictMe
apiBase: https://api.predictme.me/api/v1/agent
agentsJson: https://app.predictme.me/agents.json
metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The registration step sends the owner's email address to an external service. This is functionally necessary, but it involves transmitting personal data off-platform and initiating account creation, so it becomes a true security/privacy concern if done without clear consent and notice.

Content

Scanner excerpt · skill.md (reported line 46)May include surrounding context.

md
owner_email = ask_owner("What email should I register with?")

# Step 2: Register via API
response = POST("https://api.predictme.me/api/v1/agent/register", {
    "email": owner_email,
    "agentName": "YourAgentName",       # Pick a memorable name
    "description": "AI trader using momentum strategy"  # Optional

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Polling the external status endpoint is part of the registration workflow, but it also retrieves a one-time API key that enables subsequent authenticated trading actions. Because this is credential-bearing external communication, mishandling the response could lead to credential exposure or unauthorized activation of the agent.

Content

Scanner excerpt · skill.md (reported line 57)May include surrounding context.

md
# Step 3: Poll for admin approval
# Owner can also check at: https://app.predictme.me/agents (Status Tracker)
while True:
    status = GET(f"https://api.predictme.me/api/v1/agent/status/{agent_id}")
    if status.data.status == "VERIFIED":
        api_key = status.data.apiKey   # ONE TIME — save immediately!
        save_credentials(agent_id, api_key)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs automatic storage of API credentials in a local JSON file and emphasizes convenience, but provides only minimal protection guidance. If implemented as written, API keys may be stored insecurely, exposed to other local processes, committed accidentally, or reused without rotation, enabling unauthorized account access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trading loop is an automation template for placing repeated bets, but it lacks a strong upfront warning that it performs irreversible or account-affecting actions and can continue unattended. In the context of a trading skill, this omission is risky because users may enable it without understanding that it can autonomously consume balance and execute many trades quickly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code transmits betting instructions, commentary, and authentication headers to an external API. External transmission is expected for the skill's function, but it is still security-relevant because it performs remote state-changing financial actions and could expose sensitive data or trigger unauthorized bets if the surrounding controls are weak.

Content

Scanner excerpt · skill.md (reported line 334)May include surrounding context.

md
commentary = generate_trade_commentary(
                asset, best_grid, current_price, base_price, best_ev
            )
            result = requests.post(f"{BASE}/bet", headers=headers, json={
                "gridId": best_grid["gridId"],
                "amount": f"{bet_amount:.2f}",
                "balanceType": "TEST",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims agents should confirm with the owner before trading and validate extreme preferences, yet the earlier sample flow performs registration, credential acquisition, and trading autonomously. This mismatch encourages implementers to deploy unattended financial actions without meaningful consent controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that the agent should wait for explicit owner approval before each bet when requireApproval is true, but the provided trading loop never enforces that check. This creates a consent bypass where account-affecting actions occur automatically despite documented safeguards, increasing the risk of unauthorized trading and financial loss.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skill.md:59