UniClaw Prediction Market

• Analyzed: May 12, 2026, 3:35 AM
• Findings: 1
• Version: 0.2.1
• Hash: d9527abcebb3488609c77380dacbd6f95e57a698dd2ff64c7178a1e6e17c526a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several vulnerabilities, though it lacks clear evidence of intentional malice. Key concerns include the ability to override the `UNICLAW_SERVER` environment variable (lib/config.ts), which could redirect cryptographically signed API requests to an attacker-controlled server. Additionally, the `scripts/withdraw.ts` functionality allows sending tokens to an arbitrary address, presenting a significant prompt injection risk against the AI agent. A hardcoded `UNICITY_API_KEY` (lib/wallet.ts) for an oracle is also present, which could be a minor vulnerability depending on its privileges. While these are vulnerabilities and potential attack surfaces, the skill's code and instructions (SKILL.md) are transparently aligned with its stated purpose of interacting with a prediction market, and do not contain explicit malicious commands or data exfiltration attempts.