ClawHub

Polymarket Weather Scanner

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Polymarket weather-analysis helper that calls its hosted API for forecasts and market edge, without evidence of trading authority, credential theft, persistence, or destructive behavior.

Install only if you are comfortable sending forecast or weather-market scan requests, your IP address, and any configured POLYMARKET_SCANNER_API_KEY to the hosted scanner service. Use a dedicated scanner API key, do not provide wallet or trading credentials, and check POLYMARKET_SCANNER_HOST before use if your environment defines it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises executable shell commands (`bash {baseDir}/scripts/*.sh`) while declaring no permissions, which creates a transparency and governance gap. Even if the commands are expected for the skill’s function, hidden execution capability can bypass user or platform expectations and increase the risk of command execution against external services without explicit consent controls.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The `/scan` guidance uses broad triggers such as asking to 'scan weather markets,' 'find opportunities,' or 'check for edge,' which can match ordinary conversational requests and cause the agent to invoke the shell script unexpectedly. Because the command reaches an external API and may consume quota or disclose the user’s interest/query context, overbroad activation increases the chance of unintended tool execution.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The `/forecast` guidance is broad enough to trigger on common weather questions, potentially causing tool execution when a user only wanted general information. Since the command executes a shell script and sends city/date parameters to an external service, this can lead to unintended network access, quota use, and unnecessary disclosure of user-request details.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal