ClawHub
Back to skill

Security audit

Nash0 Polymarket CLI

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Polymarket CLI helper that can perform sensitive trading actions only with user confirmation and keeps wallet/private-key management user-only.

Use this mostly for read-only market research unless you intentionally want to trade. Before approving any order, cancellation, approval, bridge, API-key, or notification change, verify the exact market/token, side, price, size, and account. Never paste a private key into chat, and run wallet setup/import/show/reset commands yourself in your own terminal.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly lists multiple private-key sources, including a CLI flag, environment variable, and a local config file, and even shows a config example containing a private_key field. In an agent skill context, this materially increases the chance that an automated system or user will expose, echo, store, or retrieve sensitive credentials from insecure locations without strong warnings, especially since the skill is meant to drive terminal interactions.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
polymarket setup
polymarket wallet create
polymarket wallet create --force
polymarket wallet import 0xPRIVATE_KEY
polymarket wallet address
Confidence
88% confidence
Finding
create polymarket wallet create --force polymarket wallet import 0xPRIVATE_KEY polymarket wallet address polymarket wallet show polymarket wallet reset polymarket wallet reset --force ``` ### Trading

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.