UniClaw Prediction Market

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:49 AM UTC
• Version: 0.2.1

Overview

The skill appears aligned with prediction-market trading, but it deserves review because it can move UCT, mutate live trading state, and handles raw wallet key material with limited safeguards.

Install only if you trust the UniClaw service and publisher. Use a dedicated low-balance or testnet Unicity wallet, verify UNICLAW_SERVER before running scripts, and manually confirm every deposit amount, order, cancellation, and withdrawal destination. Avoid running the smoke test on a funded account unless you accept that it can change live trading state.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and instructs use of networked scripts and environment-based configuration, yet declares no permissions. That creates a transparency and consent problem: users or agent frameworks may not realize the skill can contact remote services and consume environment-controlled endpoints, which is especially sensitive in a finance-related skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a genuine security-relevant mismatch because the skill does more than passive market browsing and trading assistance: it registers accounts, uses wallet material for signing, deposits funds to a server-controlled system, and supports withdrawals to arbitrary addresses. In a crypto trading context, those hidden or under-emphasized behaviors materially increase custody, phishing, and fund-loss risk if users do not fully understand that assets leave their wallet and become dependent on a remote service.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code deliberately bypasses the SDK's public safety boundary by reading the internal `_identity` object and returning the raw wallet private key. For a prediction-market trading skill, exposing exportable signing material is unnecessary and greatly increases the chance of wallet compromise if any other code path, logging, plugin, or prompt-driven action accesses or transmits it.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script exposes an agent registration capability that is not reflected in the stated skill scope of trading, browsing markets, and managing positions. Even though the code itself is straightforward, undisclosed identity- or account-lifecycle actions expand the skill's effective permissions and can surprise users, reviewers, or calling agents, increasing the risk of unauthorized onboarding or misuse of the wallet-backed signing key.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The deposit instructions describe sending tokens directly to the server without an explicit warning that the transfer may be irreversible and exposes the user to custodial and financial loss risk. In a token-trading skill, omission of transfer-finality warnings makes accidental or uninformed loss more likely, especially for autonomous agents acting on concise instructions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The withdrawal instructions allow transfer to any address but do not warn users to verify the destination carefully. In crypto systems, an incorrect or attacker-supplied address can cause immediate, irreversible loss of funds, and the risk is heightened here because the skill normalizes arbitrary-address withdrawals.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The function extracts highly sensitive wallet key material without any user-facing notice, consent, or disclosure, creating a stealthy credential-access path. In an agent skill context, this is especially dangerous because downstream tool logic could use or exfiltrate the key invisibly, enabling full takeover of the user's trading wallet and any assets controlled by it.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The smoke test loads a wallet private key and uses it for authenticated API calls to a configured server, but it provides no explicit warning that wallet-derived credentials are being sent to a remote service. In a trading skill context this is security-relevant because users may run the script against a non-local or misconfigured server and unintentionally expose signing/authentication material or authorize account-linked actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This smoke test submits and cancels live orders on a real market using the user's wallet-backed account, which can change balances, consume funds, and create market activity. The absence of an explicit safety warning, dry-run mode, or interactive confirmation makes accidental execution materially risky, especially in a trading skill where authenticated actions are expected to affect financial state.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "type": "module",
  "dependencies": {
    "@noble/curves": "^2.0.1",
    "@noble/hashes": "^2.0.1",
    "@unicitylabs/sphere-sdk": "^0.5.4"
  },

• Confidence: 92% confidence
• Finding: "@noble/curves": "^2.0.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"type": "module",
  "dependencies": {
    "@noble/curves": "^2.0.1",
    "@noble/hashes": "^2.0.1",
    "@unicitylabs/sphere-sdk": "^0.5.4"
  },
  "devDependencies": {

• Confidence: 92% confidence
• Finding: "@noble/hashes": "^2.0.1"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@noble/curves": "^2.0.1",
    "@noble/hashes": "^2.0.1",
    "@unicitylabs/sphere-sdk": "^0.5.4"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",

• Confidence: 95% confidence
• Finding: "@unicitylabs/sphere-sdk": "^0.5.4"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@unicitylabs/sphere-sdk": "^0.5.4"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }

• Confidence: 83% confidence
• Finding: "@types/node": "^22.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/node": "^22.0.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

• Confidence: 84% confidence
• Finding: "tsx": "^4.21.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"devDependencies": {
    "@types/node": "^22.0.0",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

• Confidence: 83% confidence
• Finding: "typescript": "^5.9.3"

VirusTotal

53/53 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.