Prediction Stack Setup

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.1.1

Overview

This setup skill is coherent with its trading-stack purpose, but it deserves review because it stores trading/API secrets, enables persistent automated monitoring and phone alerts, and includes troubleshooting steps that can expose secrets.

Install only if you want persistent automated prediction-market monitoring and iMessage alerts. Before running it, review the cron and heartbeat schedules, use revocable least-privilege API keys, secure ~/.openclaw and private-key file permissions, confirm the iMessage recipient, avoid sharing raw troubleshooting output, and do not run diagnostics that print full config or live secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The script reaches out to an additional third-party service, Polymarket, that is not disclosed in the module docstring's validation scope and is not described in the skill metadata. Unexpected outbound network calls increase supply-chain and privacy risk because users may run the validator without realizing it contacts extra services.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README explicitly promotes configuring API keys, scheduled automation, and routing alerts to iMessage via BlueBubbles, but it does not warn users about secure credential storage, least-privilege handling, or the fact that alerts may traverse external services and devices. In a setup wizard that centralizes secrets in a unified config and enables automated delivery, this omission increases the chance of users exposing sensitive tokens or unintentionally sending trading-related data to third-party systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to create recurring cron jobs and proactive messaging behavior, which introduces ongoing autonomous actions after a one-time setup. Without a strong upfront warning about persistence, frequency, external messaging, and possible costs, users may unknowingly enable continuous monitoring and outbound notifications.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Heartbeat configuration enables continuous background checks and possible outbound iMessage sends, extending the skill's behavior beyond the immediate session. This increases privacy and operational risk because the system can monitor state and message users repeatedly without a sufficiently prominent consent boundary.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide recommends loading and printing the full parsed configuration with `json.dumps(config, indent=2)`, which is likely to reveal API keys, private key paths, proxy settings, and other sensitive values directly in terminal output or shell history capture. In a setup/troubleshooting context this creates an avoidable secret-exposure risk, especially if users paste output into bug reports, chats, or shared logs.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manual Anthropic test performs a real authenticated API call using the user's key and prints the model response, but the guide does not warn that this transmits data to a third party, may incur billing, and can expose key-backed activity during troubleshooting. Even though the payload is trivial, operationally it encourages live secret use and external transmission without safety context.

VirusTotal

66/66 vendors flagged this skill as clean.