ClawHub
Back to skill

Security audit

Garden Temp Market (GTM)

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for a Base prediction-market helper, but it gives agents ready-to-submit real-money betting transactions and raw private-key command examples without adequate safety gates.

Review before installing. Use this only with an explicit spending limit, a dedicated low-value wallet, and human approval for every transaction. Do not paste production private keys into commands, prompts, logs, or agent workflows; prefer a wallet, hardware signer, or managed keystore that shows the chain, contract address, calldata, and ETH value before signing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:99
Finding

Wallet Private Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:99-106; equivalent unsafe examples also appear in PLAYERS.md:33-44
Vulnerability Type: Private-key exposure through process arguments
Risk Level: Medium

bash
# Bet HIGHER
cast send 0xA3F09E6792351e95d1fd9d966447504B5668daF6 "betHigher()" \
  --value 0.01ether --rpc-url https://mainnet.base.org --private-key $KEY

# Bet LOWER
cast send 0xA3F09E6792351e95d1fd9d966447504B5668daF6 "betLower()" \
  --value 0.01ether --rpc-url https://mainnet.base.org --private-key $KEY

Technical Analysis

These instructions pass a raw wallet private key through the --private-key command-line option. The shell expands $KEY before starting cast, causing the secret to become part of the process argument vector.

Depending on operating-system access controls and execution environment, process arguments may be visible through process-monitoring utilities, /proc interfaces, debugging tools, shell wrappers, audit systems, diagnostic telemetry, or command-execution logs. The same pattern appears in PLAYERS.md, where users are instructed to substitute YOUR_PRIVATE_KEY directly.

Exploitation requires an attacker, monitoring component, or insufficiently isolated co-tenant to have access to the relevant process metadata. The project does not itself collect or transmit the private key, but its recommended invocation method unnecessarily exposes a high-value secret.

Attack Path

  1. A user exports the wallet private key as $KEY and follows the documented command.
  2. The shell expands $KEY into the cast process argument list.
  3. A local process, privileged monitoring agent, CI logger, debugging utility, or compromised co-tenant captures the process arguments.
  4. The attacker extracts the private key.
  5. The attacker imports the key into another wallet or signer.
  6. The attacker signs arbitrary transactions and transfers any assets controlled by that extern ...[truncated 421 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all examples that pass raw private keys through --private-key.
  • Recommend an encrypted Foundry keystore and interactive password entry, for example through cast wallet import and an account-based signing workflow.
  • Prefer a hardware wallet, isolated signing service, or wallet application that displays transaction destination, calldata, chain, and value before approval.
  • In automated environments, use a dedicated low-value wallet and a secrets manager integrated with an isolated signer rather than placing the private key in environment variables or command arguments.
  • Warn users never to paste private keys into shell commands, chat interfaces, agent prompts, logs, or Bankr requests.
  • Update both SKILL.md and PLAYERS.md so all signing examples follow the hardened workflow.

T08 · Insecure Dependencies

Warning
Location
lib/forge-std/scripts/vm.py:15
Finding

Mutable Unverified Remote Input Used to Generate Solidity Source

Content
View full analysis

Vulnerability Details

File Location: lib/forge-std/scripts/vm.py:15-15, 25-35, 72-77
Vulnerability Type: Unpinned supply-chain input without integrity verification
Risk Level: Medium

python
CHEATCODES_JSON_URL = "https://raw.githubusercontent.com/foundry-rs/foundry/master/crates/cheatcodes/assets/cheatcodes.json"
OUT_PATH = "src/Vm.sol"


def main():
    parser = argparse.ArgumentParser(
            description="Generate Vm.sol based on the cheatcodes json created by Foundry")
    parser.add_argument(
            "--from",
            metavar="PATH",
            dest="path",
            required=False,
            help="path to a json file containing the Vm interface, as generated by Foundry")
    args = parser.parse_args()
    json_str = request.urlopen(CHEATCODES_JSON_URL).read().decode("utf-8") if args.path is None else Path(args.path).read_text()
    contract = Cheatcodes.from_json(json_str)

    # ...

    with open(OUT_PATH, "w") as f:
        f.write(out)

    forge_fmt = ["forge", "fmt", OUT_PATH]
    res = subprocess.run(forge_fmt)
    assert res.returncode == 0, f"command failed: {forge_fmt}"

Technical Analysis

When invoked without --from, the generator downloads JSON from the mutable master branch of the Foundry repository. The downloaded content is not pinned to a reviewed commit and is not checked against a cryptographic digest or signature.

The remote data is parsed and converted into Solidity declarations before being written to src/Vm.sol. Although the script does not directly evaluate the downloaded JSON as Python code, the remote content influences generated source code that may later be compiled and used by the project. HTTPS protects transport in ordinary conditions but does not protect against compromise of the upstream repository, account, branch, or publishing workflow.

Running forge fmt on the generated file does not validate its safety or p ...[truncated 1397 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the master URL with a URL pinned to a specific reviewed commit hash.
  • Store an expected SHA-256 or stronger cryptographic digest in the repository and reject downloaded content that does not match it.
  • Prefer a reviewed, locally vendored cheatcodes.json file and require explicit action to update it.
  • Make --from mandatory in security-sensitive or reproducible build workflows.
  • Review generated diffs before compilation or commit, and prevent automated pipelines from accepting unexplained changes to src/Vm.sol.
  • Pin the vendored forge-std dependency to a known revision and document a controlled dependency-update process.
  • If remote updates remain supported, download to a temporary file, validate schema and integrity, and only then atomically replace the generated output.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

bash
# Load environment variables
source .env

# Deploy and verify
forge script script/Deploy.s.sol:DeployDailyTempMarket \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation instructs users to pass a raw private key directly on the command line via --private-key YOUR_PRIVATE_KEY without any explicit warning about secret handling, transaction irreversibility, phishing risk, or safe wallet practices. Even though this is common in low-level tooling, presenting it plainly in a player-facing guide increases the chance that users or agents will expose credentials through shell history, logs, screenshots, or unsafe automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to load a private key from .env and broadcast a deployment to Base mainnet without an explicit warning that this sends a real on-chain transaction using live funds. In a deployment skill, that omission can cause operators to unintentionally use a funded key or target production infrastructure before validating configuration on a testnet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides concrete instructions and ready-to-submit transaction payloads for sending ETH to a prediction market contract, including examples that use a private key with cast send, but it does not clearly warn users that these bets are irreversible and can result in total fund loss. In an agent context, this is dangerous because it lowers friction for executing value-bearing on-chain actions while omitting safety gates such as confirmation prompts, risk disclosures, spender/value verification, and guidance to avoid exposing private keys.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · broadcast/Deploy.s.sol/8453/run-1770799076743.json (reported line 32)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · broadcast/Deploy.s.sol/8453/run-latest.json (reported line 32)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 71)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 86)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 101)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 116)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 131)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · lib/forge-std/test/fixtures/broadcast.log.json (reported line 176)May include surrounding context.

json
"status": "0x1",
      "cumulativeGasUsed": "0xcd1fa9",
      "logs": [],
      "logsBloom": "0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "type": "0x2",
      "transactionHash": "0x7fe844fe1ecdc75f7eeb6c26b16f80a542a3b9f122d00bfd6c539ff8842e4682",
      "transactionIndex": "0x2b",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · foundry.toml (reported line 16)May include surrounding context.

toml
# Etherscan verification (Base uses Basescan)
[etherscan]
base = { key = "${BASESCAN_API_KEY}", url = "https://api.basescan.org/api" }
base_sepolia = { key = "${BASESCAN_API_KEY}", url = "https://api-sepolia.basescan.org/api" }

# See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lib/forge-std/scripts/vm.py (reported line 103)May include surrounding context.

python
f.write(out)

    forge_fmt = ["forge", "fmt", OUT_PATH]
    res = subprocess.run(forge_fmt)
    assert res.returncode == 0, f"command failed: {forge_fmt}"

    print(f"Wrote to {OUT_PATH}")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

When --from is not supplied, the script silently downloads JSON from a remote GitHub URL and uses that unpinned content to generate source code. This creates a supply-chain and reproducibility risk: if the remote content is altered, unavailable, or intercepted via a compromised trust chain, generated artifacts may unexpectedly change without explicit user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description states what the skill does, but it does not define when it should be invoked, what user requests should activate it, or any exclusions, which can lead to overly broad matching in systems that infer activation from manifest text.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency on ethers uses a caret range (^6.16.0), which permits automatic installation of future compatible releases. This can introduce supply-chain risk if a newly published version contains a security regression, malicious code, or behavior changes that affect blockchain transaction handling in a betting/financial context.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"author": "potdealer x Ollie",
  "license": "MIT",
  "dependencies": {
    "ethers": "^6.16.0"
  },
  "repository": {
    "type": "git",

Static analysis

No suspicious patterns detected.