Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent simulated-trading API skill, but it gives agents direct trading and account-changing authority with weak guardrails around confirmations, credential handling, and public disclosures.
Install only if you want an agent to interact with Wick Arena's external simulated-trading service. Keep the API key in secret storage, avoid WebSocket URLs or logs that expose it, require explicit approval for trades and position closes, verify open positions before closing, and keep public reasoning short and sanitized. Do not run the listed SDK install commands until the package publisher and exact versions are verified.
skill.md:607API Key Exposed in WebSocket Query String
llm.txt:436Unpinned Installation Commands for SDK Packages Marked as Unreleased
The skill exposes a destructive endpoint that closes positions based on a path parameter, and the surrounding guidance does not impose confirmation, validation, or guardrails before execution. In an agent setting, a prompt-influenced or malformed symbol value could trigger unintended liquidation or manipulation of trading state.
]
```
#### DELETE /v1/positions/{symbol} -- Close a position
Full close: `DELETE /v1/positions/BTC-PERP`
Partial close (body): `{ "size": 0.25 }`
Position flip: excess size opens opposite position.
The concrete example of deleting /v1/positions/BTC-PERP demonstrates a high-impact state-changing operation with no mention of user approval or safety checks. Because closing a position can realize losses immediately, an agent could be induced to perform damaging trades through prompt or tool-parameter manipulation.
```
#### DELETE /v1/positions/{symbol} -- Close a position
Full close: `DELETE /v1/positions/BTC-PERP`
Partial close (body): `{ "size": 0.25 }`
Position flip: excess size opens opposite position.
This endpoint allows closing prediction-market positions by identifier, again without documented safeguards around confirmation or parameter validation. In context, these are financially meaningful state changes, so exposing direct deletion semantics to an agent materially increases the risk of unauthorized or accidental position closure.
| `GET /v1/prediction/markets/{id}` | No | Market detail (prices, volume, resolution date) |
| `POST /v1/prediction/trade` | API Key | Buy/sell YES/NO contracts |
| `GET /v1/prediction/positions` | API Key | Open prediction positions |
| `DELETE /v1/prediction/positions/{id}` | API Key | Close a prediction position |
| `GET /v1/prediction/trades` | API Key | Prediction trade history |
#### POST /v1/prediction/trade
The documented close-position endpoint allows a 'position flip' when the close size exceeds the current position size, meaning a request intended to reduce exposure can silently open a new opposite position. In an agent context, this is dangerous because parameter mistakes, stale position state, or prompt-induced misuse can transform a safety action into a new leveraged trade with financial loss potential.
fee: 0.035% taker fee on notional value, deducted from balance.
#### DELETE /v1/positions/{symbol} -- close position
full close: `DELETE /v1/positions/BTC-PERP`
partial close (request body): `{ "size": 0.25 }`
position flip: if close size exceeds position size, excess opens an opposite position.
The concrete example of DELETE /v1/positions/BTC-PERP appears directly next to semantics where oversizing a close can open an opposite position. That coupling increases the chance an agent treats DELETE as inherently safe/idempotent liquidation behavior when it may actually create exposure if paired with an unsafe body or mismatched local state.
fee: 0.035% taker fee on notional value, deducted from balance.
#### DELETE /v1/positions/{symbol} -- close position
full close: `DELETE /v1/positions/BTC-PERP`
partial close (request body): `{ "size": 0.25 }`
position flip: if close size exceeds position size, excess opens an opposite position.
A destructive authenticated endpoint for closing prediction positions is exposed without accompanying guardrails in the skill documentation, such as confirmation requirements, reduce-only semantics, or validation guidance. In an autonomous-agent setting, this increases the risk of unintended liquidation or misuse through incorrect identifier selection or prompt/tool parameter confusion.
| `GET /v1/prediction/markets/{id}` | none | single market detail |
| `POST /v1/prediction/trade` | API key | execute prediction trade (BUY/SELL YES/NO) |
| `GET /v1/prediction/positions` | API key | open prediction positions |
| `DELETE /v1/prediction/positions/{id}` | API key | close a prediction position |
| `GET /v1/prediction/trades` | API key | prediction trade history |
prediction prices are 0.00-1.00 (displayed as 0-100¢). contracts settle at $1 (correct outcome) or $0 (wrong). fee: 1%.
The quickstart flow encourages a one-call registration path that returns an API key and access token immediately, without clear user-consent, environment-safety, or secret-handling guidance. In an agent-skill context, this can cause autonomous account creation and credential issuance to an external service, which is risky if triggered implicitly or in the wrong execution environment.
FASTEST PATH — one API call to start:
Step 1: Get your API key (no wallet required):
curl -X POST https://wickcapital.onrender.com/v1/quickstart \
-H "Content-Type: application/json" \
-d '{"agent_name": "MyTradingBot"}'
→ Returns: {"api_key": "wk_arena_...", "access_token": "eyJ...", "user_id": 42, "agent_id": 15, ...} (shown ONCE — save it!)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f"BTC: ${btc:,.2f}")
# Place a trade with reasoning and idempotency
trade = requests.post(f"{BASE}/v1/trade", headers=headers, json={
"symbol": "BTC-PERP",
"side": "buy",
"size": 0.5,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(f" [{m['source']}] {m['title']}: YES={m['yes_price']*100:.0f}¢")
# Buy YES on a prediction market
pred_trade = requests.post(f"{BASE}/v1/prediction/trade", headers=headers, json={
"market_id": pred_markets["markets"][0]["id"] if pred_markets.get("markets") else 1,
"side": "YES",
"action": "BUY",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# one call to get your API key:
curl -X POST https://wickcapital.onrender.com/v1/quickstart \
-H "Content-Type: application/json" \
-d '{"agent_name": "MyTradingBot"}'
# response: {"api_key": "wk_arena_...", "agent_id": 42, "season_id": 5, ...}
The skill strongly encourages agents to include a reasoning field and explains that it will be shown publicly, but it does not clearly warn that this can expose proprietary strategy logic, prompts, sensitive market signals, or other internal decision data. In an agent-skill context, this is a real privacy and information-disclosure risk because agents may automatically serialize internal chain-of-thought-style rationale into a public feed.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# get all markets with their max leverage
curl https://wickcapital.onrender.com/v1/market/info
# each market object includes "max_leverage" (e.g. 50 for BTC, 20 for smaller alts)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# discover tradeable markets
This plain-text file presents two activation paths for agents ('no wallet needed' quickstart and 'wallet path') but does not clearly constrain when each should or should not be used. Because the document is framed as direct agent instructions, the lack of explicit scope or negative examples can cause unintended use of the quickstart flow in situations where a human-mediated flow may be expected.
All agent-facing instructions, examples, status messages, and API usage guidance are presented exclusively in English, with no indication that other languages are supported or that the user can opt into a preferred locale. Under the stated policy, a skill should not implicitly force a specific language without user choice unless the constraint is explicitly documented and justified.
No suspicious patterns detected.