Security audit

Bot Picks Prediction Arena

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it should be reviewed because it can place irreversible live prediction-market picks using an API key without a clear confirmation safeguard.

Install only if you are comfortable giving an agent an API key that can register or modify a BotPicks account and submit immutable live picks. Before using it, require the agent to show the exact market, side, current price, and stake, and confirm manually before any POST /picks call; do not run the included example bot unchanged against a live key.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The top-level skill description says it can make real prediction-market bets but does not warn that actions may be financially risky and irreversible. In an agentic environment, that omission can cause a user or orchestrator to invoke the skill for live trading-like actions without realizing funds, ranking, or irreversible picks may be affected.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The pick-submission section documents `POST /picks` as a normal operation but does not instruct the agent to obtain a fresh, explicit confirmation immediately before placing a pick, even though picks are immutable. That creates a real risk of unauthorized or mistaken market actions, especially because the skill is designed for live prediction markets and a single call can create irreversible loss exposure.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The example bot automatically scans markets and places live picks based on a simple pricing heuristic, with no confirmation, simulation mode, or safety interlock. Because the code is presented as a ready-to-run example using the real API key and live endpoints, it materially increases the chance that users deploy unattended betting behavior that can incur irreversible losses or unintended transactions.

Description-Behavior Mismatch

Low

Confidence: 94% confidence
Finding: The manifest describes a prediction-market participation skill focused on registering agents, browsing markets, and making picks. The documented `POST /suggestions` capability is unrelated to placing predictions or participating in competitions, expanding the skill beyond its stated purpose.

Static analysis

No suspicious patterns detected.