aimpact-prediction-market

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:09 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent prediction-market alert helper, but it tells users to set up indefinite background checks without enough controls or removal guidance.

Install only if you want a Chinese-language prediction-market alert skill and understand its external API usage. Do not add the provided cron or Windows scheduled task unless you intentionally want ongoing background OpenClaw runs; if you do, define an end date, monitor message/API volume, and keep your own removal command handy.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:93

Finding

Recurring OS-Level Scheduled Task Creates Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:93-101
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code

bash

# Linux/macOS crontab（每 15 分钟检查一次）
*/15 * * * * openclaw agent --message "检查预测市场变化"

powershell

# 创建每 15 分钟检查任务
schtasks /create /tn "预测市场监控" /tr "openclaw agent --message '检查预测市场变化'" /sc minute /mo 15

Technical Analysis

The documented commands instruct users to register recurring operating-system tasks that invoke OpenClaw every 15 minutes. The cron entry and Windows scheduled task survive the original Skill invocation and continue operating across user sessions.

Periodic monitoring is relevant to the declared prediction-market alert functionality, and the commands are presented as optional examples rather than commands executed automatically by bundled code. Nevertheless, OS-level persistence is not necessary for the Skill's manual query functionality and exceeds the minimum privileges required for a single invocation.

The instructions do not define an expiration time, execution limit, explicit confirmation workflow, failure backoff, logging policy, or corresponding removal procedure. Consequently, a user who follows the examples may unintentionally authorize indefinite unattended Agent execution. The documentation also describes monitoring as automatically enabled elsewhere while later stating that scheduled checks are optional and externally configured, which may obscure the persistence implications.

Attack Path

1. A user follows the scheduled-monitoring instructions in SKILL.md.
2. The user adds the cron entry or executes the schtasks /create command.
3. The operating system stores the recurring task under the user's account.
4. Every 15 minutes, the task starts openclaw agent without a new interactive request.
5. The Agent loads the Skill instructions, reads local source and trigger configuration, and requests the configur ...[truncated 1221 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to manual invocation and clearly state that installation does not automatically enable background monitoring.

2. Prefer an OpenClaw-native scheduler with narrowly scoped permissions over operating-system cron or Task Scheduler persistence.

3. Require explicit, informed confirmation immediately before creating any recurring task.

4. Use a finite expiration time or execution count by default, with indefinite monitoring requiring a separate opt-in.

5. Apply minimum practical frequency, API rate limits, failure backoff, execution timeouts, and message deduplication.

6. Log each unattended execution and make task status visible to the user.

7. Provide exact removal instructions. For Windows, document:

   powershell

   schtasks /delete /tn "预测市场监控" /f
   

   For Unix-like systems, assign the entry a unique marker and document how to remove only that marked cron entry.

8. Ensure the scheduled process runs as an unprivileged user and cannot access tools or credentials unrelated to prediction-market monitoring.

9. Pin or validate the Skill and source configuration used by unattended runs so later unauthorized modifications are not silently exercised.

10. Reconcile the conflicting documentation that describes monitoring as automatically enabled while also describing scheduling as optional.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and all invocation instructions are written only in Chinese, and the skill specifies Chinese trigger phrases such as “查询预测市场热门事件” and “检查预测市场变化” as the activation commands. This effectively imposes a specific language/locale for use without documenting user opt-in or offering an alternative language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file strictly mandates a single output format and language conventions ('必须严格遵循此格式，不得修改符号或结构') without any user opt-in or fallback. This can override user preferences or downstream safety/UX requirements, making the skill less controllable and potentially causing instruction-priority conflicts, though it does not directly enable code execution or data exfiltration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.