ClawHub
Back to skill

Security audit

Market Trading Workflow

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly coherent, but its live-order path can submit a larger amount than it reports after applying its own conservative sizing rule.

Review before installing. This skill can place paper trades by default and real-money trades when --live is used with configured credentials. Do not use live mode until the submitted amount is fixed to match the reported stake-sized amount, and treat optional wallet/private-key configuration as high-risk.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions while its documented behavior clearly involves network access and local file interaction through scripts and reference files. This creates a transparency and trust problem: hosts or reviewers may approve the skill under a false capability profile, and users may invoke it without understanding that it can read local data, write outputs, or reach external services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The skill is presented as a conservative World Cup fixture-trading workflow, but the described behavior extends into broader external research, market scanning, and nontrivial data enrichment from third-party sources. That mismatch is dangerous because users and platforms may grant trust based on a narrow trading purpose while the skill actually has a wider operational scope and more opportunities for data exfiltration, unreliable decisioning, or unreviewed side effects.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The module advertises 'dry-run by default', but when --live is not set the code still calls client.trade() and labels the outcome 'paper-trade'. If the backend or venue configuration does not strictly isolate paper from live execution, users may place real trades while believing execution is disabled, creating a high-risk safety and financial-loss condition.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The script computes a reduced trade_amount via stake_multiplier() for conservative sizing, but in live mode it submits args.amount to client.trade() while recording decision['amount'] as the reduced value. This mismatch can cause larger-than-disclosed live orders, undermining risk controls and exposing operators to unintended financial loss.

Static analysis

No suspicious patterns detected.