Security audit

Polyclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed real-money trading and token-promotion workflow, but it needs careful review because it handles powerful credentials, mutable remote skill dependencies, and automated financial/social actions with weak safeguards.

Install only if you are comfortable giving this service real trading authority, creating a public performance token, and allowing automated or recurring social promotion. Use a dedicated account, minimal funds, tightly scoped/revocable credentials, review every remote skill before enabling it, avoid running the registration script in logged automation, and rotate any keys printed or captured in transcripts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:842
Finding: Mandatory Token Promotion Hijacks Agent Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:848
Finding: Unpinned Remote Skills Create a Mutable Instruction Supply Chain
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/register.sh:225
Finding: Registration Script Exposes the Full Agent API Key in Standard Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/register.sh:38
Finding: Environment-Controlled API Host Receives the Operator-Wide Bearer Credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.sh:140
Finding: Registration Payload Is Constructed Through Unsafe JSON Interpolation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/api-reference.md:577
Finding: Third-Party Backend Receives High-Privilege Trading and Social Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill markets itself as an autonomous trader, but the actual content is primarily a workflow for collecting an operator API key, registering with a third-party service, storing one-time credentials, and provisioning wallets/token infrastructure. That mismatch can mislead operators and downstream agents into disclosing sensitive secrets and enabling live financial operations under the assumption they are only enabling analysis/trading logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill markets itself as an autonomous trader, but the actual content is primarily a workflow for collecting an operator API key, registering with a third-party service, storing one-time credentials, and provisioning wallets/token infrastructure. That mismatch can mislead operators and downstream agents into disclosing sensitive secrets and enabling live financial operations under the assumption they are only enabling analysis/trading logic.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill markets itself as an autonomous trader, but the actual content is primarily a workflow for collecting an operator API key, registering with a third-party service, storing one-time credentials, and provisioning wallets/token infrastructure. That mismatch can mislead operators and downstream agents into disclosing sensitive secrets and enabling live financial operations under the assumption they are only enabling analysis/trading logic.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: The documented delete endpoint permanently removes an agent and all associated data using only an agent key, with no mention of additional confirmation, soft-delete, or recovery controls. In an autonomous trading context, a compromised or misused tool invocation could irreversibly destroy trading history, configuration, and linked operational state.
Content: Scanner excerpt · references/api-reference.md (reported line 338)May include surrounding context.
Delete an agent and all associated data.

text
DELETE /agents/{id} Authorization: Bearer {agentApiKey}

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The API explicitly accepts Twitter access and refresh tokens, meaning the service is designed to collect and store high-value social-media credentials. Because this skill is primarily for financial trading, the added credential-custody capability is especially dangerous: compromise of the agent, backend, or logs could lead to persistent takeover of linked Twitter accounts and secondary social-engineering abuse.
Content: Scanner excerpt · references/api-reference.md (reported line 1390)May include surrounding context.
md
| Field | Type | Required | Description | | ------------ | ------ | -------- | -------------------------- | | accessToken | string | Yes | OAuth access token | | refreshToken | string | Yes | OAuth refresh token | | handle | string | Yes | Twitter handle | | userId | string | Yes | Twitter user ID |

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script tells users that trading starts automatically once funded, but the registration payload explicitly sets "tradingEnabled": false. In a financial automation context, this mismatch can cause users to fund wallets under false assumptions, leading to unattended capital exposure, operational confusion, or delayed response when trading does not occur as expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The machine-readable JSON includes the full Agent API Key, making accidental exposure highly likely in logs, wrappers, automation frameworks, and downstream process captures. Because this key is required for all trading operations, leakage directly enables unauthorized access and potentially fraudulent trades or account manipulation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes shell-based operational flows and numerous network/API actions but declares no explicit tool scope or permission boundaries. In an agent setting, this increases the risk of unintended execution of sensitive actions such as registration, trading, selling positions, and withdrawals because the runtime lacks least-privilege constraints.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 445)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 453)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 508)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 564)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 571)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 594)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 609)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 636)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 645)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 659)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 713)May include surrounding context.
API Endpoint

text
POST https://api.polyclaw.ai/agents Authorization: Bearer {operatorApiKey} Content-Type: application/json

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:270

Overview

A.I.G

T01 · Skill Instruction Hijacking

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tp4

Tp4

Tp4

Tool Parameter Abuse

Credential Access

Intent-Code Divergence

Missing User Warnings

Undeclared Tool Scope

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

External Transmission

API Endpoint

Static analysis

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.