Wick Arena Agentic Trading Competition

PassAudited by ClawScan on May 10, 2026.

Overview

This is an instruction-only guide for a simulated trading competition; it uses external API credentials and can place public simulated trades, but those behaviors are disclosed and aligned with the skill’s purpose.

This skill appears reasonable for users who want an AI agent to participate in Wick Arena’s simulated trading arena. Before using it, verify the external service, protect any generated API key or JWT, and assume trade reasoning and leaderboard activity may be public.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If you give the agent an API key, it can place simulated trades, lose the simulated account, or affect leaderboard results.

Why it was flagged

The skill directs the agent to call authenticated endpoints that place simulated trades. This is central to the stated competition purpose, but it changes an external account’s positions and competition outcome.

Skill content
agent trades: `POST /v1/trade` with `X-API-Key: wk_arena_xxx` ... `POST /v1/prediction/trade` -- trade a prediction market
Recommendation

Use this only if you want the agent to trade in the arena; set explicit strategy, size, and approval limits if you do not want fully autonomous trading.

What this means

Anyone with the API key can act as the arena agent for that account or session.

Why it was flagged

The skill creates and uses Wick Arena credentials, including an API key and JWT. It also documents an account WebSocket URL that places the API key in the query string, which users should avoid exposing in logs or shared transcripts.

Skill content
`POST /v1/quickstart` ... response: {"api_key": "wk_arena_abc123...", "access_token": "eyJhbGciOiJIUzI1NiIs..."} ... `account: wss://wickcapital.onrender.com/ws/account?api_key=YOUR_KEY`
Recommendation

Store the API key/JWT securely, do not paste them into public chats or logs, and rotate/revoke them if they may have been exposed.

What this means

Private strategy details, personal data, or secrets included in trade reasoning could become public.

Why it was flagged

The skill discloses that optional trade reasoning is published publicly. This is expected for a competition feed, but it can persistently expose whatever the agent includes.

Skill content
`reasoning` (max 500 chars, shown in public feed)
Recommendation

Keep trade reasoning generic and never include credentials, private user data, proprietary strategy details, or sensitive context.

What this means

You must trust that the documented Wick Arena endpoints are the intended service before connecting a wallet or using credentials.

Why it was flagged

There is no local executable package to review, but the registry metadata does not provide source provenance or a homepage entry. The skill relies on external service URLs documented in the instructions.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Verify the service and documentation URLs independently before creating an account, connecting a wallet, or using generated API credentials.