ClawHub
Back to skill

Security audit

Neckr0ik Polymarket Trader

Security checks for vulnerabilities and agentic risk

Overview

The skill is a purpose-aligned Polymarket market-scanning helper, but its documentation advertises some commands and webhook behavior that are not implemented.

Install only if you are comfortable with a market-data tool that may contact Polymarket and use POLYMARKET_API_KEY when present. Expect some documented commands to fail until the author fixes the CLI/documentation mismatch, and treat outputs as trading signals rather than guaranteed profit advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior does not align cleanly with the advertised purpose and referenced implementation, which is a security-relevant trust issue. When a skill claims some behaviors, omits others, or introduces undeclared functionality, users and agent frameworks may make unsafe assumptions about what will run, what data will be processed, or which external services will be contacted.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises operational commands that imply network access and possible environment usage, but it does not declare any tool scope or permissions. This creates a transparency and least-privilege problem: a host agent or reviewer cannot easily tell what capabilities the skill expects, increasing the risk of overbroad execution or unintended data access.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The webhook option allows transmission of monitoring results to arbitrary external URLs without any warning, trust boundary explanation, or restrictions. This can lead to exfiltration of trading signals, market interests, timing data, or other operational metadata to attacker-controlled endpoints, especially if an agent auto-populates or follows user-supplied URLs.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The module docstring claims support for `monitor` and `cross-platform` commands, but the actual argparse setup only defines `scan`, `endgame`, and `news`. This is an active contradiction between the documented interface and the implemented behavior, not just missing detail.

Static analysis

No suspicious patterns detected.