ClawHub
Back to skill

Security audit

Polymarket Honest Sim

Security checks for vulnerabilities and agentic risk

Overview

The skill is aimed at paper-trading simulation, but it makes a mutable live web document authoritative for integration and authentication details outside the reviewed package.

Install only if you are comfortable with the agent consulting live PaperBook documentation while building integrations. Keep credentials scoped to PaperBook paper trading, do not reuse real trading secrets, review any fetched signing code before running it, and reject any remote instructions that redirect credentials or traffic away from the expected paperclob.com service.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:15
Finding

Mutable Remote Authentication Instructions Are Treated as Authoritative

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-25, corroborated by reference.md:3-6
Vulnerability Type: Remote payload retrieval and execution through mutable external instructions
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:15-25:

markdown
Before writing any integration code, fetch:

https://paperclob.com/llms-full.txt

text

That file is the canonical, always-current spec — auth (L2 HMAC code you can
paste), every endpoint, order shapes, rate limits, and a **validation
checklist** to run before declaring the integration done. It is generated from
the same source as the in-app "Copy for AI" briefs and never drifts from the
server. Do not code the endpoints from memory or from this skill; this skill
covers the workflow and the interpretation, the contract lives there.

reference.md:3-6:

markdown
This file carries the parts that don't change: what the honest lenses mean,
how to read the report, and the integration gotchas. For the current wire
contract (endpoints, shapes, limits, paste-ready signing code), always fetch
`https://paperclob.com/llms-full.txt` — if the live server disagrees with
anything written anywhere, the server wins.

Technical Analysis

The Skill requires an Agent to retrieve a mutable document from an external server before creating integration code. That document can contain paste-ready HMAC authentication code, endpoint definitions, and validation instructions. The audited package expressly declares the live document authoritative over the locally reviewed Skill.

This creates a post-review payload substitution channel. The effective integration instructions are not versioned or included in the audited package, so their safety cannot be established by reviewing these files. If the domain, hosting account, deployment pipeline, DNS, or served document is compromised, the remote content could be changed to include unsafe code, pr ...[truncated 2218 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete API contract and reviewed signing implementation in the Skill package rather than requiring mutable remote instructions.
  2. If remote retrieval is necessary, reference an immutable, versioned artifact and verify it using a cryptographic hash or authenticated signature pinned in the Skill.
  3. Treat remotely fetched text strictly as untrusted reference data, not as Agent instructions or directly executable code.
  4. Remove language stating that the remote server automatically overrides all reviewed local documentation.
  5. Enforce an explicit allowlist for API origins and reject signing or credential transmission to any unexpected host.
  6. Require user confirmation before executing code obtained from the remote specification or sending credentials to a newly introduced endpoint.
  7. Keep secrets in protected credential storage, redact them from logs, and scope them exclusively to the intended paper-trading service.
  8. Publish versioned API changes through a reviewable update process so changes to authentication and network behavior receive the same security review as the Skill.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep