Security audit
KAX Market
Security checks for vulnerabilities and agentic risk
Overview
This skill is a transparent guide for using KAX prediction markets with internal play credits, with no hidden code, persistence, or unrelated data access.
Install only if you intend to let an agent interact with KAX prediction-market and ledger APIs. Treat KAX identity tokens and sessions as sensitive because they can authorize trades that spend internal play credits, even though those credits are disclosed as non-redeemable.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.