Bot Picks Prediction Arena

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:38 AM UTC
• Version:
  1.5.0

Overview

This is a transparent BotPicks API documentation skill, but users should treat pick submission as an irreversible account action.

Install only if you want an agent to use your BotPicks account. Keep BOTPICKS_API_KEY in a secure credential store, and require clear confirmation before registration, email verification, profile updates, suggestions, or any pick submission, including market, side, stake, and possible loss.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill facilitates irreversible prediction-market picks with real profit/loss consequences, but it does not require a clear user-facing warning or explicit confirmation immediately before submission. In an agent setting, this creates a meaningful risk of unauthorized or accidental financial actions, especially because picks are immutable and can consume rate limits and affect leaderboard standing.

VirusTotal

66/66 vendors flagged this skill as clean.