T09 · Insecure Skill Coding Practices
Error
- Location
discipline_scanner.py:23- Finding
Automated trading uses an unverified hardcoded wallet identity
- Content
View full analysis
- Remediation
View remediation
Security audit
PolyClaw Pro
Security checks for vulnerabilities and agentic risk
Overview
This Polymarket trading skill is not clearly malicious, but it can use wallet keys for unattended trades and redemptions and contains hardcoded, incomplete account-handling code that needs careful review.
Review this skill before installing. Use only a low-balance throwaway wallet, do not enable the cron jobs or API swap bridge until the hardcoded wallet addresses are removed, all missing modules are supplied and audited, dependencies are pinned, and every transaction path has explicit account checks, limits, and manual approval for first-time or high-impact actions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
discipline_scanner.py:76- Finding
Automated take-profit scanner permits execution at 50% below the reported price
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
polyclaw_api.py:246- Finding
Pre-trade risk check fails open with a fabricated balance
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
check_books.py:8- Finding
Read-only order-book utility unnecessarily loads a private key and derives authenticated credentials
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
auto_redeem_check.py:108- Finding
Auto-redemption grants persistent operator approval over all conditional tokens
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
pyproject.toml:7- Finding
Security-sensitive dependencies are resolved from mutable version ranges without a lockfile
- Content
View full analysis
=7.0.0", "httpx[socks]>=0.28.0", "py-clob-client>=0.34.0", "eth-account>=0.13.0", "python-dotenv>=1.0.0", "curl-cffi>=0.14.0", ] ``` ### Technical Analysis All dependencies use open-ended lower bounds, and the audited artifact contains no lockfile. Future installations can therefore resolve newer versions that were not reviewed with this code. This is especially significant because `web3`, `eth-account`, and `py-clob-client` run in processes that load private keys, derive credentials, sign transactions, and submit orders. No malicious package name or nonstandard package source was observed; the issue is mutable and unreproducible resolution rather than confirmed dependency confusion. ### Attack Path 1. A new dependency or transitive dependency release becomes available. 2. A user follows the documented `uv sync` installation procedure. 3. The resolver selects the new, unreviewed release because no upper bound or committed lockfile constrains it. 4. The package executes in a process containing wallet secrets and signing authority. 5. A compromised or behaviorally incompatible release could expose credentials or alter transaction behavior. ### Impact Assessment The possible scope includes the environment variables, wallet private key, CLOB credentials, RPC traffic, signed transactions, and trading operations available to the application process. ]]>- Remediation
View remediation
other
Warning
- Location
polyclaw_api.py:24- Finding
Distributed artifact omits local modules required for documented security-sensitive operations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A substantial description-behavior mismatch is security-relevant because users may grant wallet, network, and secret access under false assumptions about what the skill actually does. In this context, undeclared proxy usage, private-key-derived API auth, or hidden wallet-specific behavior would materially change the trust boundary for a financial automation skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A substantial description-behavior mismatch is security-relevant because users may grant wallet, network, and secret access under false assumptions about what the skill actually does. In this context, undeclared proxy usage, private-key-derived API auth, or hidden wallet-specific behavior would materially change the trust boundary for a financial automation skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A substantial description-behavior mismatch is security-relevant because users may grant wallet, network, and secret access under false assumptions about what the skill actually does. In this context, undeclared proxy usage, private-key-derived API auth, or hidden wallet-specific behavior would materially change the trust boundary for a financial automation skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
The documented pattern of sourcing a .env file before running a transaction-capable script exposes sensitive credentials into the process environment and normalizes secret handling through shell commands. In a wallet-enabled trading skill, this increases the blast radius of accidental disclosure via subprocesses, shell history, debugging output, misconfigured permissions, or multi-user systems.
- Content
bash # Manual run cd {baseDir} && source .env && .venv/bin/python3 auto_redeem_check.py # Cron (every 15 minutes) */15 * * * * cd /path/to/polyclaw && source .env && .venv/bin/python3 auto_redeem_check.py >> /var/log/polyclaw-redeem.log 2>&1
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Embedding cron examples that source .env for an automated redeem script encourages persistent unattended use of wallet secrets in an environment-exposed form. Because the script can redeem on-chain positions, compromise of that runtime or its logs/process metadata could lead to unauthorized fund movements or operational abuse.
- Content
cd {baseDir} && source .env && .venv/bin/python3 auto_redeem_check.py
Cron (every 15 minutes)
*/15 * * * * cd /path/to/polyclaw && source .env && .venv/bin/python3 auto_redeem_check.py >> /var/log/polyclaw-redeem.log 2>&1
text - Requires `web3` (use `.venv/bin/python3`, not system python)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Using
export $(grep -v "^#" .env | xargs)is particularly risky because it performs brittle shell parsing of secrets and exports them broadly to the process environment. In a financial automation context, this can mis-handle special characters, leak credentials to child processes, and create avoidable exposure for the private key used to sell positions automatically.- Content
bash # Manual run cd {baseDir} && export $(grep -v "^#" .env | xargs) && .venv/bin/python3 discipline_scanner.py # Cron (every 30 minutes) */30 * * * * cd /path/to/polyclaw && export $(grep -v "^#" .env | xargs) && .venv/bin/python3 discipline_scanner.py >> /var/log/polyclaw-discipline.log 2>&1
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
The cron-based discipline scanner combines automated trade execution with environment-exported secrets, creating a high-risk unattended pathway for asset sales. If the host, job definition, or environment handling is compromised, an attacker may gain access to the private key or influence automated sell behavior.
- Content
cd {baseDir} && export $(grep -v "^#" .env | xargs) && .venv/bin/python3 discipline_scanner.py
Cron (every 30 minutes)
*/30 * * * * cd /path/to/polyclaw && export $(grep -v "^#" .env | xargs) && .venv/bin/python3 discipline_scanner.py >> /var/log/polyclaw-discipline.log 2>&1
text - Skips positions worth less than $1
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """Auto-redeem checker: runs via cron, checks if winning positions have resolved on-chain. When payoutDenominator > 0, immediately redeem via NegRiskAdapter. Add to crontab: */15 * * * * cd /root/.openclaw/skills/polyclaw && source .env && .venv/bin/python3 auto_redeem_check.py >> /var/log/polyclaw-redeem.log 2>&1 """ import os, json, urllib.request, ssl, time from datetime import datetime, timezone
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """Auto-redeem checker: runs via cron, checks if winning positions have resolved on-chain. When payoutDenominator > 0, immediately redeem via NegRiskAdapter. Add to crontab: */15 * * * * cd /root/.openclaw/skills/polyclaw && source .env && .venv/bin/python3 auto_redeem_check.py >> /var/log/polyclaw-redeem.log 2>&1 """ import os, json, urllib.request, ssl, time from datetime import datetime, timezone
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python #!/usr/bin/env python3 """Auto-redeem checker: runs via cron, checks if winning positions have resolved on-chain. When payoutDenominator > 0, immediately redeem via NegRiskAdapter. Add to crontab: */15 * * * * cd /root/.openclaw/skills/polyclaw && source .env && .venv/bin/python3 auto_redeem_check.py >> /var/log/polyclaw-redeem.log 2>&1 """ import os, json, urllib.request, ssl, time from datetime import datetime, timezone
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Ensure .env is loaded from dotenv import load_dotenv load_dotenv(Path(__file__).parent / ".env") from portfolio_tracker import PortfolioTracker
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This API bridge exposes a
swap autopathway that delegates directly to a local trading helper and can trigger irreversible asset conversions. In the skill context, this bridge is designed for remote bot invocation over SSH, so exposing a high-impact trading action without confirmation, allowlisting, or clear guardrails materially increases the chance of accidental or unauthorized asset movement.- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Passing the full parent environment to a subprocess (
env={**os.environ}) unnecessarily propagates all loaded secrets, including Web3 credentials from.env, intoswap.py. In this skill, the bridge explicitly loads secrets and performs financial operations, so broad environment inheritance expands the blast radius if the helper script, its dependencies, logging, or error handling are compromised.- Content
python result = subprocess.run( [sys.executable, str(Path(__file__).parent / "swap.py"), action], capture_output=True, text=True, timeout=120, env={**os.environ}, ) print(result.stdout) if result.stderr:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requests or implies powerful capabilities (environment access, file read/write, network, shell) but does not declare an explicit tool scope or permission boundary. In a trading skill that handles private keys and can submit transactions, this increases the risk of overbroad execution and makes review, sandboxing, and user consent materially weaker.
- Content
Unbounded Output
Medium
- Category
- Output Handling
- Confidence
- 60% confidence
- Finding
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Content
md **Output options:** - Default output is a formatted table (good for display) - Use `--full` flag for full question text without truncation - Use `--json` flag via `scripts/markets.py --json trending` for structured JSON output ### Wallet Management
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The automation sections describe unattended execution paths that can redeem positions or sell profitable holdings on a cron schedule, but the warning about autonomous financial actions is not prominent relative to the instructions. In a live trading skill using a private key from environment variables, this can cause unintended fund movement or liquidation if misconfigured, triggered in the wrong environment, or used by an inattentive operator.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This script automatically signs and broadcasts on-chain transactions using a hot private key loaded from the environment, then is explicitly intended to run unattended via cron. In the context of a trading/portfolio automation skill, that creates real risk of irreversible asset movement, accidental approvals, and damage from misconfiguration or compromise of the host, environment, or upstream data sources without any human review at execution time.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This script is presented as an order-book checker, but it initializes a trading client with a private key and derives API credentials even though the visible functionality only reads public market and order-book data. Loading signing material unnecessarily expands the blast radius: anyone running the script exposes sensitive credentials to imported code paths, memory, logs, exceptions, or future modifications without any operational need for read-only book inspection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code silently reads a private key from an environment variable and immediately uses it to derive API credentials, with no disclosure to the user that running a seemingly read-only utility will access wallet secrets. In the context of a trading skill that also includes automation and API bridging, this is more dangerous because users may execute helper scripts assuming low risk while unintentionally exposing high-value credentials needed for account actions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script is mislabeled as checking current positions, but it never authenticates to a wallet, exchange, or portfolio source and only fetches public market data based on hardcoded queries and trending lists. In a trading/automation skill, this can mislead users or downstream agents into believing the output reflects actual holdings, which may drive incorrect trading, hedging, or risk-management decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code sends the wallet address in outbound requests to the Polymarket Data API, which transmits user/system-linked financial metadata over the network. While the code includes technical docstrings, it does not provide a clear user-facing warning that wallet information will be shared with external services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads the POLYCLAW_PRIVATE_KEY environment variable and derives the wallet address from it, which is sensitive credential handling. Although the function has a docstring about balances, there is no explicit warning, confirmation, or user-facing disclosure that private-key-backed credentials are being accessed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a Polymarket trading and portfolio skill, and while token swapping may fit that domain, this file's API bridge implements that feature by spawning a separate Python process. Subprocess execution is a broader capability than the stated bridge/portfolio interface and is not justified by the manifest text for this interface layer itself.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def cmd_swap(action): """Delegate to swap.py.""" import subprocess result = subprocess.run( [sys.executable, str(Path(__file__).parent / "swap.py"), action], capture_output=True, text=True, timeout=120, env={**os.environ},
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest file describes the skill only as a "Trading-enabled Polymarket skill for OpenClaw" without specifying any concrete invocation phrases, scope limits, or exclusion conditions. In a manifest, such broad natural-language descriptions can contribute to ambiguous matching and unintended activation because the trigger context is not clearly bounded.
- Content
Static analysis
No suspicious patterns detected.