T09 · Insecure Skill Coding Practices
Error
- Location
lib/wallet.ts:23- Finding
Hard-Coded Oracle API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
UniClaw Prediction Market
Security checks for vulnerabilities and agentic risk
Overview
Review recommended because this prediction-market skill can move UCT tokens and use wallet secrets, but its safeguards and disclosures are not strong enough for that authority.
Use this only with funds you are willing to risk, preferably on testnet. Before installing, confirm the server endpoint, avoid custom or plaintext endpoints, review the wallet and private-key handling, and do not run deposit or withdrawal commands unless you personally verify the amount and destination.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
lib/api.ts:13- Finding
Request Signatures Do Not Bind the HTTP Method, Path, or Destination
- Content
View full analysis
{ const signed = signRequest(body, privateKeyHex); const res = await fetch(`${config.serverUrl}${path}`, { method: 'POST', headers: signed.headers, body: signed.body, }); ``` The same body-only signing pattern is used for GET and DELETE requests: ```ts export async function apiGet(path: string, privateKeyHex: string): Promise { const signed = signRequest({}, privateKeyHex); const res = await fetch(`${config.serverUrl}${path}`, { method: 'GET', headers: signed.headers, }); } export async function apiDelete(path: string, privateKeyHex: string): Promise { const signed = signRequest({}, privateKeyHex); const res = await fetch(`${config.serverUrl}${path}`, { method: 'DELETE', headers: signed.headers, }); } ``` ### Technical Analysis The signature authenticates only a serialized body and timestamp: ```ts JSON.stringify({ body, timestamp }) ``` It does not authenticate the HTTP method, normalized request path, intended host, protocol version, or a ...[truncated 1505 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/config.ts:4- Finding
Configurable API Endpoint Permits Plaintext or Attacker-Controlled Servers
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deposit.ts:24- Finding
Deposit Sends Tokens to an Unverified Server-Supplied Address
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trade.ts:28- Finding
Financial Inputs Are Parsed Without Strict Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (61)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill description emphasizes trading and position management, but the file also includes a withdrawal feature that transfers tokens to arbitrary external addresses. That is a materially different and higher-risk capability because it enables direct asset exfiltration, and it is not highlighted in the top-level description or permission model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description emphasizes trading and position management, but the file also includes a withdrawal feature that transfers tokens to arbitrary external addresses. That is a materially different and higher-risk capability because it enables direct asset exfiltration, and it is not highlighted in the top-level description or permission model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description emphasizes trading and position management, but the file also includes a withdrawal feature that transfers tokens to arbitrary external addresses. That is a materially different and higher-risk capability because it enables direct asset exfiltration, and it is not highlighted in the top-level description or permission model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The skill description emphasizes trading and position management, but the file also includes a withdrawal feature that transfers tokens to arbitrary external addresses. That is a materially different and higher-risk capability because it enables direct asset exfiltration, and it is not highlighted in the top-level description or permission model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description emphasizes trading and position management, but the file also includes a withdrawal feature that transfers tokens to arbitrary external addresses. That is a materially different and higher-risk capability because it enables direct asset exfiltration, and it is not highlighted in the top-level description or permission model.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/market.ts list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/market.ts list
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/trade.ts buy --market <id> --side yes --price 0.35 --qty 10
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/trade.ts buy --market <id> --side yes --price 0.35 --qty 10
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/trade.ts buy --market <id> --side yes --price 0.35 --qty 10
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/trade.ts buy --market <id> --side yes --price 0.35 --qty 10
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/portfolio.ts balance
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md npx tsx scripts/portfolio.ts balance
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code silently reads a mnemonic from disk and restores a wallet without any user-facing disclosure or consent at the point of use. In an agent skill context, hidden access to seed phrases materially increases the risk of unauthorized signing, wallet surveillance, or later exfiltration of the most sensitive wallet secret.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This helper deliberately bypasses the SDK's public safety boundary by reaching into the internal
_identityobject to return the raw private key. Exposing a reusable private key is far more powerful than the stated trading functionality requires, and any downstream code, logging, compromise, or prompt-driven misuse could exfiltrate the wallet and enable irreversible theft of funds or impersonation.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - Body: `{ "side": "yes"|"no", "price": 0.35, "quantity": 10 }` - Response: `{ "orderId": 1, "fills": [{ "price": 0.35, "quantity": 5, "counterpartyOrderId": 2 }] }` ### DELETE /api/agent/markets/:id/orders/:orderId Cancel an order. - Response: `{ "cancelled": true }`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares no explicit tool scope or permissions even though it clearly relies on environment access, local wallet files, and network communication. In a financial skill that can move tokens and interact with a remote server, missing scope declarations reduce transparency and can cause an agent or user to authorize broader capabilities than expected.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill instructs users to register an account and deposit funds to a server-backed trading balance, implying persistent off-chain session or account state tied to wallet identity. Persistence itself is expected for a trading platform, but it becomes security-relevant because long-lived authenticated state and stored balances increase the consequences of credential misuse or server compromise.
- Content
Use the unicity_top_up agent tool, or: openclaw unicity top-up
text 2. **Register** — create your UniClaw accountnpx tsx scripts/register.ts
text
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Using
npx tsxwithout pinning a version allows execution behavior to depend on whatever package version is resolved at runtime. That creates a supply-chain risk where a compromised or changed upstream package could execute unintended code in a context that has wallet and network access.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The deposit step instructs users to send tokens directly to the UniClaw server but does not clearly warn that this is a custodial transfer where control shifts from the user's wallet to the service. In a financial context, lack of explicit custody and privacy disclosure can mislead users about the risk of loss, account freezing, or off-chain handling of balances.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The unpinned
npx tsxinvocation makes the registration flow dependent on an externally resolved package version. Because registration likely uses wallet identity and network access, a malicious package update could harvest credentials or alter requests.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
An unversioned
npx tsxinvocation is a supply-chain exposure because runtime code may change independently of the skill contents. In a token trading workflow, that can directly affect order-related actions and any secrets loaded from the wallet path.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The detail command also depends on mutable
npx tsxresolution. Even read-oriented commands are risky because the runtime may still access environment variables, wallet files, or network endpoints under attacker-controlled package behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
Executing trade placement via unpinned
npx tsxis more dangerous than read-only operations because it can trigger asset-affecting actions. A compromised runtime package could tamper with order parameters, leak wallet material, or submit unauthorized requests while appearing to place a normal trade.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The NO-side trade command carries the same supply-chain risk as the YES-side command, but in a value-transferring context where collateral is committed. Mutable runtime resolution could change business logic, exfiltrate credentials, or place unintended orders.
- Content
Static analysis
No suspicious patterns detected.