ClawHub
Back to skill

Security audit

The Moat Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it installs a per-minute autonomous trading loop that stores and sends an API key, and its trade decisions can be influenced by untrusted social-feed text.

Install only if you are comfortable with an autonomous agent running every minute, using your local LLM budget, storing a Bearer API key in ~/.thepit/config.json, and submitting trades to The Pit. Use the default https://api.thepit.run endpoint unless you fully trust a custom server, monitor ~/.thepit/heartbeat.log and your crontab, and remove the cron entry if you want the agent to stop.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
prompt-template.md:41
Finding

Untrusted Social-Feed Content Is Embedded in the Trading Agent Prompt

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
install.sh:29
Finding

Arbitrary API Base URL Can Receive the Plaintext Bearer Credential

Content
View full analysis
"${THEPIT_DIR}/config.json" <
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (20)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 126)May include surrounding context.

md
crontab -l | grep -v "thepit-skill" | crontab -

# Remove config + logs
rm -rf ~/.thepit

# Remove the skill itself (OpenClaw command)
openclaw skills uninstall thepit/moat-trader

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SECURITY.md (reported line 126)May include surrounding context.

md
crontab -l | grep -v "thepit-skill" | crontab -

# Remove config + logs
rm -rf ~/.thepit

# Remove the skill itself (OpenClaw command)
openclaw skills uninstall thepit/moat-trader

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SECURITY.md (reported line 15)May include surrounding context.

md
- **No background processes beyond ONE cron entry** that runs
  `heartbeat.sh` once per minute. You can remove it any time.
- **No outbound HTTP except to the single URL** configured in
  `~/.thepit/config.json` (default `https://api.thepit.run/external/*`).
- **No LLM API keys stored by this skill.** The skill invokes your
  existing `openclaw agent --local` configuration — whatever model
  you've already wired.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
- **No background processes beyond ONE cron entry** that runs
  `heartbeat.sh` once per minute. You can remove it any time.
- **No outbound HTTP except to the single URL** configured in
  `~/.thepit/config.json` (default `https://api.thepit.run/external/*`).
- **No LLM API keys stored by this skill.** The skill invokes your
  existing `openclaw agent --local` configuration — whatever model
  you've already wired.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawhub.json (reported line 58)May include surrounding context.

json
- **No background processes beyond ONE cron entry** that runs
  `heartbeat.sh` once per minute. You can remove it any time.
- **No outbound HTTP except to the single URL** configured in
  `~/.thepit/config.json` (default `https://api.thepit.run/external/*`).
- **No LLM API keys stored by this skill.** The skill invokes your
  existing `openclaw agent --local` configuration — whatever model
  you've already wired.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The document explicitly states the skill establishes persistence via cron. Even though disclosed and expected for a scheduled trading agent, persistence increases attack surface because compromised or modified scripts would execute automatically every minute without further user action.

Content

Scanner excerpt · SECURITY.md (reported line 20)May include surrounding context.

md
existing `openclaw agent --local` configuration — whatever model
  you've already wired.
- **No filesystem access outside `~/.thepit/`** except the cron entry
  (via `crontab -l | crontab -`).

## What this skill actually does on your machine

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 30)May include surrounding context.

and api_base. Writes:

text
~/.thepit/config.json         chmod 600 — only your user can read
~/.thepit/heartbeat.log       append-only log of each heartbeat call

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

This describes concrete cron modification behavior that installs recurring execution. Persistent execution is not inherently malicious here, but it is a real persistence mechanism and can be abused if the script path or referenced files are later tampered with.

Content

Scanner excerpt · SECURITY.md (reported line 34)May include surrounding context.

~/.thepit/heartbeat.log append-only log of each heartbeat call

text

Then calls `crontab -l` → filters out any existing `thepit-skill`
entries → appends one new entry → pipes to `crontab -`. Effect:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 81)May include surrounding context.

md
action.
- ❌ No broadcast to other skills or agents. All state is scoped to
  `~/.thepit/`.
- ❌ No sudo / root operations.

## What you must trust

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill installs a cron-driven trading loop and modifies local configuration, but the user warning is not prominently stated at the point of installation/setup. Because this is an autonomous trading skill, insufficient disclosure increases the risk that users enable recurring financial actions and persistent system changes without fully understanding the operational and monetary consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 123)May include surrounding context.

md
},
    "scheduling": {
      "cron": true,
      "description": "install.sh registers ONE cron entry to invoke heartbeat.sh every minute. User can remove via `crontab -l | grep -v thepit-skill | crontab -`."
    }
  },
  "personas": [

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · clawhub.json (reported line 67)May include surrounding context.

json
},
    "scheduling": {
      "cron": true,
      "description": "install.sh registers ONE cron entry to invoke heartbeat.sh every minute. User can remove via `crontab -l | grep -v thepit-skill | crontab -`."
    }
  },
  "personas": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.sh (reported line 119)May include surrounding context.

sh
causalPostId: (if $causal == "null" then null else $causal end)
  } | with_entries(select(.value != null))')

RESPONSE=$(curl -sS --max-time 5 \
  -X POST \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "Content-Type: application/json" \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The comment says re-running is safe because it overwrites config.json but not scheduled jobs. However, the cron install logic removes only lines containing the marker text "thepit-skill" and then appends a new marker plus job, so it does modify scheduled jobs and may leave prior heartbeat entries in place if they lacked that marker. This is an active contradiction between the documentation and the implemented behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CHANGELOG.md (reported line 45)May include surrounding context.

md
"skill_dir": "${SKILL_DIR}"
}
EOF
chmod 600 "${THEPIT_DIR}/config.json"

# Make heartbeat.sh executable
chmod +x "${SKILL_DIR}/heartbeat.sh"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SECURITY.md (reported line 104)May include surrounding context.

md
"skill_dir": "${SKILL_DIR}"
}
EOF
chmod 600 "${THEPIT_DIR}/config.json"

# Make heartbeat.sh executable
chmod +x "${SKILL_DIR}/heartbeat.sh"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 42)May include surrounding context.

sh
"skill_dir": "${SKILL_DIR}"
}
EOF
chmod 600 "${THEPIT_DIR}/config.json"

# Make heartbeat.sh executable
chmod +x "${SKILL_DIR}/heartbeat.sh"

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The script establishes persistence by registering heartbeat.sh in the user’s crontab to run every minute. Even though this may be intended functionality, persistence mechanisms are security-relevant because they ensure continued code execution after installation, increase blast radius if the skill or its directory is later modified, and may be non-obvious to users reviewing the install script quickly.

Content

Scanner excerpt · install.sh (reported line 49)May include surrounding context.

sh
# Install cron entry
CRON_LINE="*/1 * * * * ${SKILL_DIR}/heartbeat.sh >> ${THEPIT_DIR}/heartbeat.log 2>&1"
(crontab -l 2>/dev/null | grep -v "thepit-skill"; echo "# thepit-skill: heartbeat"; echo "$CRON_LINE") | crontab -

echo ""
echo "✓ Config written to ${THEPIT_DIR}/config.json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill gives concrete trading instructions, entry/exit rules, and position sizing without any warning that these are speculative strategies that can cause financial loss. This is dangerous because it can encourage users or downstream agents to treat the content as actionable investment guidance while underestimating risk, especially since the strategy explicitly promotes concentrated exposure based on social signals.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The skill operationalizes autonomous trading decisions by defining explicit conditions for entering and exiting positions based on external posts, author history, and time-based confirmation logic. In context, this is more dangerous because it delegates market actions to social-media sentiment and clout metrics, creating a path for manipulation, herd-following, and automated losses without meaningful human judgment.

Content

Scanner excerpt · personas/social-follower/SOUL.md (reported line 22)May include surrounding context.

md
**Exits** — You exit when:
- The author you followed flips sentiment (re-post in opposite
  direction) → mirror them
- 4 blocks pass without confirmation from other high-clout
  authors → lone signal, probably wrong
- Unrealized PnL hits **-6%** (loss limit — the author's wrong
  this time)