T08 · Insecure Dependencies
Error
- Location
clawhub.json:4- Finding
Unpinned trading SDK executes with access to API and wallet credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Market Trading Workflow
Security checks for vulnerabilities and agentic risk
Overview
This is a real trading skill, not malware, but its live-trade safety controls are under-scoped enough that users should review it carefully before installing.
Install only if you are comfortable with a skill that can submit paper trades by default and live trades when explicitly run with --live and credentials. Before using live mode, pin dependencies, verify Simmer venue behavior, fix the warning/recommendation fail-closed logic, and correct the live submitted amount to match the reported risk-adjusted amount.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
references/publishing-flow.md:5- Finding
Mutable npx package executes during authentication and publication
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawhub_trader.py:318- Finding
Market-context warnings and non-trade recommendations do not block order submission
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawhub_trader.py:296- Finding
Live orders bypass calculated stake reduction and report an inaccurate amount
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill is presented as a trading workflow but actually only provides normalization tests or support logic, users and automated systems may rely on protections that do not exist, such as fixture validation, pricing checks, and trade gating. This kind of capability misrepresentation can lead to unsafe downstream use, especially in financial or autonomous agent contexts where execution assumptions matter.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill is presented as a trading workflow but actually only provides normalization tests or support logic, users and automated systems may rely on protections that do not exist, such as fixture validation, pricing checks, and trade gating. This kind of capability misrepresentation can lead to unsafe downstream use, especially in financial or autonomous agent contexts where execution assumptions matter.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The slug in `clawhub.json`, `SKILL.md`, and runtime tags should match.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The slug in `clawhub.json`, `SKILL.md`, and runtime tags should match.
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script advertises 'dry-run by default' and 'default is dry-run/paper', but in the non-live path it still calls client.trade(...). If the backing SDK or venue configuration treats paper mode as a real submission target, users may execute trades when they believe they are only simulating, causing unauthorized financial or operational impact.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises operational behaviors that imply network, file read, and file write access, but it does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can cause reviewers or orchestrators to grant broader capabilities than intended, increasing the chance of unauthorized data access or unexpected external actions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
Using
npx clawhub@latestis an unpinned remote execution pattern that pulls and executes whatever version is current at publish time. If the upstream package is compromised or a breaking version is released, the operator could run malicious or unsafe code during publishing or maintenance workflows.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest does not define any concrete activation constraints, despite this skill being capable of market discovery and potentially placing trades. In a trading context, broad or implicit activation increases the chance the agent invokes the workflow in unrelated conversations or under ambiguous user intent, which could lead to unintended financial actions or exposure of wallet-linked capabilities.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The publish command uses
npx clawhub@latest, which fetches and executes the most recent package version at runtime rather than a reviewed, pinned version. If the upstream package is compromised or a breaking/malicious release is published, anyone following this checklist could execute untrusted code during the publish flow.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script computes a reduced trade_amount using the conservative stake multiplier, but the live trade call submits args.amount instead. This mismatch defeats the intended risk control and misreports the executed size, which can lead to larger-than-intended exposure and hinder auditability or operator review.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a conservative World Cup fixture-trading workflow focused on discovering a market, validating a matchup, pricing an edge, and trading safely. However, this file implements pricing logic for multiple non-fixture and broader proposition markets such as tournament winner, round-of-16 qualification, group winners, and even continent-to-win markets, which extends beyond a narrow fixture/matchup workflow.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python def _market_attr(market: Any, name: str, default: Any = None) -> Any: if hasattr(market, name): value = getattr(market, name) if value is not None: return value if isinstance(market, dict):
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The module docstring repeatedly states that it produces fair prices for Polymarket, while the manifest describes the skill as a ClawHub workflow. That mismatch suggests the implementation may have been repurposed from a different platform and does not cleanly align with the declared skill intent.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The docstring characterizes the module as intentionally lightweight, yet the implementation includes optional external FotMob enrichment, recursive payload mining, remote dataset fetching, and disk caching. While not a direct functional contradiction, the documentation understates materially broader behavior and side effects than a lightweight baseline model suggests.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
When match_id or team_id is provided, the function contacts FotMob endpoints to retrieve match details and fixtures. The top-level module docstring mentions optional enrichment, but the execution path itself lacks a visible prompt or runtime disclosure that external requests will be made.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code downloads results data from GitHub and writes it to a cache file under the user's home directory. While the module docstring describes the public data source, there is no local comment, log, or prompt at the write site warning that the script performs network access and creates a persistent cache file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code hard-codes canonical team labels such as "United States", "South Korea", and "Ivory Coast" and normalizes alternate spellings into those English forms. That imposes a specific language/locale representation in output data, and the file does not indicate any user choice or justified locale constraint.
- Content
Static analysis
No suspicious patterns detected.