Prediction Stack Orchestrator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:30 PM UTC
• Version: 1.1.0

Overview

This skill is a live prediction-market trading orchestrator that also ships an unauthenticated network monitor exposing local process, config, and log data, so users should review it before installing.

Install only if you are comfortable with a skill that can direct live Kalshi trades and with reviewing or hardening the bundled monitor first. Before use, require manual confirmation for live orders, prefer paper trading during setup, bind the monitor to 127.0.0.1, add authentication, remove wildcard CORS, redact or disable process/config/log endpoints, and keep credentials out of logs and config values served to the browser.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: monitor/server.py:244

Finding

Unauthenticated Exposure of Local Operational and Trading Information

Content

View full analysis

= 11: ptype = "unknown" cmd = parts[10][:120] if "autoresearch" in cmd: ptype = "autoresearch" elif "eval_xpulse" in cmd: ptype = "eval_xpulse" elif "eval.py" in cmd: ptype = "eval_kalshalyst" elif "claude -p" in cmd: ptype = "claude_cli" elif "kalshalyst" in cmd: ptype = "kalshalyst" processes.append({ "pid": parts[1], "type": ptype, "cpu": parts[2], "mem": parts[3], "started": parts[8], "command": cmd, }) except Exception as e: processes.append({"error": str(e)}) return processes ``` ```python def get_configs(): """Read Kelly, ensemble, and market filter configs.""" configs = {} search_pa ...[truncated 4394 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: monitor/server.py:272

Finding

Wildcard CORS Permits Cross-Origin Reading of Monitoring APIs

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: monitor/index.html:7

Finding

Third-Party Runtime Scripts Loaded Without Subresource Integrity

Content

View full analysis

@import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600;700&family=Inter:wght@400;500;600&display=swap'); ``` ### Technical Analysis The dashboard loads React, ReactDOM, and Babel as executable JavaScript from a third-party CDN at runtime. Although explicit versions are present, the script elements do not contain Subresource Integrity hashes. The project also does not establish a restrictive Content Security Policy in the reviewed server or page. Consequently, the browser trusts whatever JavaScript is returned by the CDN URL at load time. If the CDN account, hosting infrastructure, DNS resolution, certificate issuance path, or another delivery component is compromised, modified script content can execute with the dashboard's origin privileges. Because the injected script runs in the same origin as the monitoring API, it can call `/api/status`, `/api/processes`, and `/api/configs` without cross-origin restrictions. Browser-side Babel also increases the amount of executable third-party code required to render a production dashboard. The external font import is not itself executable JavaScript, but it introduces an additional external request and should be covered by an explicit resource policy. ### Attack Path 1. An attacker compromises or maliciously influences a third-party dependency delivery path used by one of the CDN URLs. 2. An operator opens the monitoring dashboard. 3. The browser downloads the altered sc ...[truncated 1097 chars]

Remediation

View remediation

``` 4. Generate integrity hashes from independently verified release artifacts rather than copying untrusted values from the same delivery channel. 5. Add a restrictive Content Security Policy that allowlists only required script, style, font, and connection sources. 6. Avoid inline executable code where possible so that CSP can omit `'unsafe-inline'`. 7. Self-host fonts or explicitly restrict `style-src` and `font-src`. 8. Track frontend dependencies through a lockfile and automated vulnerability scanning if a build pipeline is introduced. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is a trading orchestrator, but the detected behavior includes running an HTTP server, exposing monitoring endpoints, enumerating local installations, inspecting processes, and exposing local logs/config data. This is a major trust-boundary mismatch: operators may enable the skill for trading workflow assistance without realizing it can also collect and publish sensitive local system information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to execute real trades and append audit logs, yet it does not prominently warn users that it can take external financial actions and persist operational data. In this context, the missing warning is especially dangerous because the skill is not merely analytical—it is an automated trading orchestrator with retry and execution logic, so a user could authorize it without informed consent about financial and privacy consequences.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill specifies file and shell-oriented behavior such as reading prompts/configs from home-directory paths and invoking external components, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where an agent runner may grant broader capabilities than users expect, increasing the chance of unintended file access or command execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The critical rules state that ensemble weights are fixed and must not deviate from 0.75/0.25. Later, the advanced capabilities section says that for misaligned Xpulse signals, the weights should be changed to 0.85/0.15 for that market. These instructions directly conflict, creating intent ambiguity about actual orchestrator behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The deployment checklist references credentials in ~/.openclaw/config.yaml and other local configuration files without any privacy or secret-handling guidance. In a skill that also reads local files and logs, failing to warn about sensitive credential material increases the risk of accidental disclosure, over-broad file access, or unsafe debugging practices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and implementation show a status dashboard server that serves HTTP endpoints, static frontend files, process listings, logs, and config snapshots. None of the code implements orchestration of Kalshalyst, Eval, and Executor agents, validation loops, or retry logic as claimed in the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The monitor enumerates host processes and exposes command lines, CPU/memory usage, and start times through unauthenticated API endpoints. In a trading/agent environment, process command lines often contain sensitive prompts, file paths, secrets, tokens, or operational details that materially aid recon and compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Collecting and serving process command lines over the API leaks sensitive local context to any reachable client, and command lines frequently include prompt text, paths, API keys, or invocation details. Because the server listens on 0.0.0.0 and allows cross-origin reads, this disclosure is easier to exploit than a purely local diagnostic tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · monitor/server.py (reported line 73)May include surrounding context.

python

"""Check for running eval, autoresearch, and claude processes."""
    processes = []
    try:
        result = subprocess.run(
            ["ps", "aux"],
            capture_output=True, text=True, timeout=5
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The server reads configuration files from PROMPT_LAB and the user's home directory and serves them over HTTP. Such configs can reveal trading strategy parameters, environment layout, and potentially secrets or internal operational assumptions, which is especially dangerous for an automated trading stack.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · monitor/server.py (reported line 213)May include surrounding context.

python

# Process checks
    for name, pattern in [("xpulse", "autoresearch_xpulse"), ("kalshalyst", "autoresearch.sh")]:
        try:
            result = subprocess.run(["pgrep", "-f", pattern], capture_output=True, text=True, timeout=5)
            status[name]["running"] = result.returncode == 0
        except Exception:
            pass

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The status API returns recent log lines from local files without authentication or disclosure, and logs commonly contain prompts, internal decisions, errors, identifiers, market positions, or credentials. Exposing these over HTTP broadens the attack surface from local-only artifacts to remote-readable sensitive operational data.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:159