ClawHub
Back to skill

Security audit

Agent Market

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it lets an agent interact with a Base Sepolia prediction market, including wallet-signed testnet transactions, without evidence of hidden data theft or unrelated behavior.

Install only if you intend an agent to submit Base Sepolia AgentMarket transactions. Use a dedicated test wallet, keep little or no valuable funds in it, verify contract addresses and market addresses before actions, and require manual review before trades, liquidity changes, bonds, disputes, arbitration, resets, or emergency withdrawals.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill exposes many irreversible, value-moving blockchain actions such as buying, selling, creating markets, posting oracle bonds, arbitrating, and claiming or withdrawing funds, but it does not present a clear upfront warning that transactions are final and can cause financial loss. In an agent setting, users may treat tool calls as routine automation, increasing the chance of accidental loss, mistaken market resolution, or unintended spending of USDC and gas.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.