ClawHub
Back to skill

Security audit

Polymarket NegRisk Arbitrage

Security checks for vulnerabilities and agentic risk

Overview

This is a real-money trading automation skill with disclosed trading intent, but it defaults to unattended live quiet execution and its claimed safeguards are not reliably enforced.

Review carefully before installing. Treat this as automated financial trading, not a safe scanner: run only in dry-run or paper-trading mode first, do not enable the managed live automaton unless you accept real-money loss risk, use a restricted API key if available, and verify dependency provenance and trade safeguards independently.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
negrisk_arb.py:142
Finding

Heuristic market grouping can combine unrelated, non-exclusive outcomes

Content
View full analysis
= 2} ``` ### Technical Analysis The arbitrage strategy is valid only when every selected market represents one member of a mutually exclusive and collectively exhaustive outcome set. The implementation does not verify that property. Instead, it derives an event key from the first few words of each question and the calendar date on which the market resolves. Different markets can share both attrib ...[truncated 1403 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
negrisk_arb.py:241
Finding

Equal-dollar order sizing does not create the equal-share basket required by the arbitrage calculation

Content
View full analysis
0 else cfg["max_position_usd"] amount = min(cfg["max_position_usd"], cfg["max_total_usd"] / len(outcomes), vol_cap) amount = max(amount, 0.50) # minimum $0.50 per bucket trades.append({ "market_id": m["id"], "side": side, "amount": round(amount, 2), }) ``` ### Technical Analysis The detection functions calculate profitability as if the trader buys one equal share of every outcome. Under that model, exactly one share pays one dollar when the event resolves. Execution instead assigns approximately the same dollar amount to each outcome. Because share quantity is the dollar amount divided by price, different prices produce different quantities. The final payout is consequently determined by the number of shares held in the winning outcome, not by the normalized price sum used during detection. For example, spending the same amount on outcomes priced at `0.80` and `0.10` creates substantially fewer shares of the expensive outcome. If the expensive outcome wins, its payout may not cover the total amount spent across the basket. The code can also skip outcomes with zero or missing prices, further violating the assumption that every possible result is covered. ### Attack Path 1. A va ...[truncated 815 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
negrisk_arb.py:221
Finding

Documented fee, slippage, position, and complete-fill safeguards are not enforced

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
negrisk_arb.py:562
Finding

Pending trade cost is not constrained by the remaining daily budget

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
clawhub.json:12
Finding

Unpinned third-party SDK creates a supply-chain execution risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tainted flow: 'api_key' from os.environ.get (line 300, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · negrisk_arb.py (reported line 301)May include surrounding context.

python
try:

        api_key = os.environ.get("SIMMER_API_KEY")
        response = requests.post(
            "https://api.simmer.markets/api/sdk/trades/batch",
            headers={
                "Authorization": f"Bearer {api_key}",

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill is described as an arbitrage scanner/executor, but the docs also show portfolio inspection, open-position handling, local trade-history reads, and reporting/statistics functionality. In a financial automation context, undisclosed access to account state and local history is security-relevant because it broadens the reachable data and actions beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill is described as an arbitrage scanner/executor, but the docs also show portfolio inspection, open-position handling, local trade-history reads, and reporting/statistics functionality. In a financial automation context, undisclosed access to account state and local history is security-relevant because it broadens the reachable data and actions beyond user expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents use of environment variables, local file reads/writes, and network/API access, but does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, this creates hidden capability expansion: a user may invoke what appears to be a simple math/arbitrage skill without realizing it can access credentials, persist data locally, and place networked trades.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description says 'No signals. No AI. Just math,' implying a narrowly defined deterministic arbitrage scanner/executor. However, the top-level documentation describes the skill as a template whose user-provided 'edge' comes from tuning thresholds, filters, and how aggressively to enter, which broadens behavior beyond simple fixed mathematical arbitrage into configurable strategy/signal logic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

These statements actively pull in different directions: one asserts the strategy is purely mechanical and signal-free, while the other says the agent decides 'when and how aggressively to enter,' which is effectively signal/strategy discretion. That is an intent-level contradiction in the file's own documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation provides direct instructions for live and scheduled automated trading without an explicit, prominent warning that real funds may be spent and losses can occur from slippage, partial fills, venue issues, or incorrect assumptions. In a financial skill, omission of such warnings increases the risk of unsafe operator use and accidental activation of high-impact actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest configures a managed automaton to run negrisk_arb.py --live --quiet, which enables unattended live trading while suppressing visible output. Although the skill includes some budget and position tunables, the manifest itself does not provide an explicit warning, confirmation gate, or default-safe posture to prevent a user from unintentionally deploying real-money trading automation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · negrisk_arb.py (reported line 301)May include surrounding context.

python
try:

        api_key = os.environ.get("SIMMER_API_KEY")
        response = requests.post(
            "https://api.simmer.markets/api/sdk/trades/batch",
            headers={
                "Authorization": f"Bearer {api_key}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · negrisk_arb.py (reported line 301)May include surrounding context.

python
try:

        api_key = os.environ.get("SIMMER_API_KEY")
        response = requests.post(
            "https://api.simmer.markets/api/sdk/trades/batch",
            headers={
                "Authorization": f"Bearer {api_key}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · negrisk_arb.py (reported line 302)May include surrounding context.

python
api_key = os.environ.get("SIMMER_API_KEY")
        response = requests.post(
            "https://api.simmer.markets/api/sdk/trades/batch",
            headers={
                "Authorization": f"Bearer {api_key}",
                "Content-Type": "application/json",

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Saying the skill acts whenever prices 'deviate from $1.00' suggests both directions of deviation or at least any detectable mispricing. The later strategy section narrows the operational behavior to under-1.00 opportunities below specific profit thresholds, which is materially more limited than the broader description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The setup instructions tell users to export an API key but do not include guidance on safeguarding credentials, using least privilege, or avoiding accidental disclosure in shells, logs, or shared environments. While not evidence of theft, poor credential-handling guidance in an automation skill increases the chance of account compromise through operator error.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.