ClawHub
Back to skill

Security audit

Lucky Lobster

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its trading purpose, but it gives agents broad real-money trading authority and tells users to persist a live trading key in local config or environment files.

Review this skill before installing if you plan to connect a funded account. Use a dedicated low-balance account or constrained budget, avoid storing the key in a workspace .env file, prefer a protected secret store, and require explicit confirmation or dry runs before placing orders, approving tokens, closing positions, or redeeming funds. Revoke and rotate the LuckyLobster key immediately if it is exposed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:94
Finding

Financially Privileged API Key Stored Persistently in Plaintext

Content
View full analysis
> ~/.openclaw/.env ``` ``` ### Technical Analysis The Skill directs the agent to persist a bearer credential in OpenClaw configuration or a plaintext environment file. It also permits use of a workspace `.env` file, which may be readable by other workspace tools, shared with collaborators, included in backups, or accidentally committed to source control. The instructions do not require restrictive file permissions, repository exclusions, encryption, an operating-system credential store, or credential rotation. The shell command uses append redirection without first securing the target file. The resulting file permissions therefore depend on the existing file and process environment. This credential is particularly sensitive because the documented key can authorize account reads and financially consequential operations, including trades, order cancellation, and redemption. Transmission of the key to the declared HTTPS API is necessary for authentication; the vulnerability is its insufficiently protected persistence at rest. ### Attack Path 1. A user completes the documented device authorization flow and receives a LuckyLobster API key. 2. The agent follows the ...[truncated 1118 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
skill.md:84
Finding

All Linked Agents Receive Excessive Financial Permissions by Default

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The instruction to append the live API key to ~/.openclaw/.env or a workspace .env file creates a direct credential exposure risk. Such files are often readable by other local processes, included in backups, accidentally committed to repositories, or exposed through debugging and environment dumping, which is especially dangerous because the credential authorizes trading activity.

Content

Scanner excerpt · skill.md (reported line 121)May include surrounding context.

Append it to ~/.openclaw/.env or the workspace .env file if one exists:

bash
echo "LUCKYLOBSTER_API_KEY=ll_abc123..." >> ~/.openclaw/.env

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 622)May include surrounding context.

Cancel an open order. Only orders with status PENDING, OPEN, or PARTIALLY_FILLED can be cancelled.

http
DELETE /orders/{orderId}

Example:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill enables live market trading, order placement, position closing, and redemption, but the top-level description does not clearly warn that actions can execute real-money trades and incur irreversible financial loss. In an agent setting, insufficient safety prompting materially increases the chance of accidental or misunderstood high-impact actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs persistent storage of an API key that grants read, trade, cancel, and redeem permissions, including appending it to local config or .env files. Persisting a live trading credential in broadly accessible local storage increases the risk of credential theft, reuse by other tools, and unintended account actions if the host or workspace is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup section tells users to persist an API key without clearly emphasizing that it is a sensitive credential granting live trading and redemption permissions. Users may treat it like routine configuration rather than a high-value secret, increasing the chance of accidental disclosure through logs, files, backups, or source control.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 254)May include surrounding context.

Example: For URL https://polymarket.com/event/btc-updown-15m-1770129900

bash
curl -H "Authorization: Bearer $LUCKYLOBSTER_API_KEY" \
  "https://luckylobster.io/api/agent/v1/markets/by-slug?slug=btc-updown-15m-1770129900"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes trading/search/position management, but the documented skill also exposes wallet/chain administration behavior via token approval transactions. Approval operations change wallet authorization state and can have broader consequences than ordinary market interaction, so omitting them from the manifest reduces transparency and can lead users to authorize more capability than expected.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
83% confidence
Finding

The linked-agent flow grants a broad default permission set including read, trade, cancel, and redeem, rather than encouraging least-privilege access. For many use cases, especially informational or search-only use, these permissions exceed what is necessary and enlarge the blast radius if the key is misused or stolen.

Content

Scanner excerpt · skill.md (reported line 92)May include surrounding context.

}

text

All linked agents receive standard permissions: **read** (view markets/orders/positions), **trade** (buy/sell), **cancel** (cancel orders), and **redeem** (settle positions).

**Step 4: Store the API Key**

Static analysis

No suspicious patterns detected.