ClawHub
Back to skill

Security audit

Prediction Market Arbiter

Security checks for vulnerabilities and agentic risk

Overview

This market-scanning skill mostly matches its purpose, but it needs Review because it handles trading credentials while recommending broader-than-needed installation paths and retaining cache data.

Review before installing. Use a dedicated virtual environment, prefer the reviewed requirements file over the unpinned pip command, remove or update unused vulnerable dependencies, configure a read-only Kalshi key, and avoid the complete-stack install unless you have reviewed those other skills. Expect outbound calls to Kalshi and Polymarket and local cache files under your home directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Unpinned installation command includes an unused dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:60-63
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install kalshi-python requests pyyaml

Technical Analysis

The documented installation command retrieves the latest available versions of three packages without enforcing the versions pinned in requirements.txt. This makes the code installed by users dependent on mutable package-index state at installation time.

The implementation does not import or use requests; it uses Python's urllib.request module for Polymarket requests. Installing requests therefore expands the dependency graph and supply-chain attack surface without being necessary for the Skill's declared functionality.

Although requirements.txt pins package versions, users following SKILL.md bypass those constraints. Version pinning alone does not provide complete integrity protection, but using the reviewed dependency manifest is safer than resolving unconstrained releases.

Attack Path

  1. A user follows the installation command in SKILL.md.
  2. Pip resolves the current releases of the named packages and their transitive dependencies rather than the versions reviewed in requirements.txt.
  3. A compromised, malicious, or unexpectedly incompatible future release is downloaded from the configured package index.
  4. Package installation hooks or subsequently imported package code execute with the privileges of the user running pip.
  5. Malicious dependency code could access files and credentials available to that user, including the configured Kalshi credential path.

Exploitation depends on compromise or substitution of a package or dependency; the audited repository itself does not contain such a malicious package.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the installing or invoking ...[truncated 274 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unconstrained command with:
    bash
    python -m pip install -r requirements.txt
  2. Remove requests from requirements.txt and installation documentation if it is not required by another verified component.
  3. Generate and distribute a lock file containing hashes, or use pip's --require-hashes option with a fully resolved requirements file.
  4. Review and pin transitive dependencies where practical.
  5. Recommend installation inside a dedicated virtual environment under a non-privileged user.
  6. Keep dependency versions updated through a controlled review and testing process rather than unconstrained resolution during user installation.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:403
Finding

Documentation recommends bulk installation of unaudited unrelated Skills

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:401-404; README.md:37-40
Vulnerability Type: Excessive third-party component installation
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md:

bash
clawhub install kalshalyst kalshi-command-center polymarket-command-center prediction-market-arbiter xpulse portfolio-drift-monitor market-morning-brief personality-engine

README.md:

bash
clawhub install kalshalyst kalshi-command-center polymarket-command-center prediction-market-arbiter xpulse portfolio-drift-monitor market-morning-brief personality-engine

Technical Analysis

The recommendation installs seven additional Skills alongside prediction-market-arbiter. These additional components are not required for the core cross-platform divergence scan and are not included in the audited project, so their instructions, scripts, dependencies, persistence behavior, and requested privileges cannot be evaluated from this repository.

This recommendation exceeds the minimum component set necessary for the declared functionality. It expands the trusted computing base and creates a supply-chain exposure in which the security of this Skill's environment depends on multiple independently distributed packages.

The command is presented as an optional complete-stack installation rather than being executed automatically. Consequently, exploitation requires a user to follow the recommendation.

Attack Path

  1. A user follows the complete-stack installation command from SKILL.md or README.md.
  2. ClawHub retrieves and installs seven external Skills not present in this audit artifact.
  3. One of those Skills, or one of its dependencies or future updates, contains unsafe or malicious instructions or executable code.
  4. The external component is loaded or invoked in the same user or Agent environment.
  5. It can act within the permissions granted to that environment, potentially accessin ...[truncated 743 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep the default installation command limited to:
    bash
    clawhub install prediction-market-arbiter
  2. Clearly label every ecosystem integration as optional and not required for core operation.
  3. List optional Skills individually with a description of why each is needed and what permissions or data it may access.
  4. Require users to review each external Skill before installation.
  5. Pin external Skill versions or integrity identifiers where the package manager supports them.
  6. Avoid one-line bulk installation recommendations for components that have not been included in the same security review.
  7. Run optional integrations with the narrowest available credentials and filesystem permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill describes capabilities that involve network access, reading credential material such as a private key file, and writing cache/log/state files, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this mismatch can lead to overbroad execution privileges, making unintended file access, secret exposure, or unauthorized outbound requests more likely if the runtime grants defaults.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

As a Cron Job (Every 4 Hours)

bash
# Add to crontab -e:
0 */4 * * * cd /path/to/prediction-market-arbiter && python scripts/arbiter.py >> /tmp/arbiter.log 2>&1

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

At L103-L105, the document says 'Numbers are normalized by platform (100000 vs 100k),' implying the current matching behavior accounts for numeric normalization. However, L231-L243 explicitly explains that '$100,000' and '100k' remain different tokens under pure Jaccard and that normalization is only an optional workaround 'currently not implemented.' This is an active contradiction in the skill documentation about what the system actually does.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is pinned to requests==2.32.5, and the supplied advisory indicates versions prior to 2.33.0 are affected by an insecure temporary file reuse issue in extract_zipped_paths(). Even if the vulnerable utility is not obviously used from this requirements file alone, pinning a known vulnerable version is a real supply-chain risk because the package may be invoked indirectly by the skill or future code changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbiter.py (reported line 143)May include surrounding context.

python
return []

    try:
        base_url = "https://api.elections.kalshi.com/trade-api/v2"
        sdk_config = KalshiConfiguration(host=base_url)
        with open(key_file, "r") as f:
            sdk_config.private_key_pem = f.read()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbiter.py (reported line 157)May include surrounding context.

python
return []

    try:
        base_url = "https://api.elections.kalshi.com/trade-api/v2"
        sdk_config = KalshiConfiguration(host=base_url)
        with open(key_file, "r") as f:
            sdk_config.private_key_pem = f.read()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persists cross-platform market scan results to disk in two cache files under the user's home directory, even though its stated purpose is only to compare markets and report divergences. Persistent storage increases data exposure and creates unintended retention of trading signals and market metadata that other local users, processes, or later workflows could access or misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.