ClawHub
Back to skill

Security audit

Polymarket News Events

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed automated news trader, but it warrants Review because live mode can place real financial trades from RSS-driven heuristics without per-trade approval.

Install only if you are comfortable with an unattended trading automaton. Keep it in dry-run first, use a dedicated low-privilege API key and isolated environment, set small trade sizes and strict venue settings, and avoid live mode until the feed validation, dependency pinning, state-file handling, and approval or exposure limits are improved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
news_events.py:176
Finding

Predictable shared temporary file permits symlink-based file overwrite and trading-state manipulation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
news_events.py:104
Finding

Plaintext HTTP RSS feed can be manipulated to influence live financial trades

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
clawhub.json:4
Finding

Unpinned dependencies and an unused package increase supply-chain exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities that require network access, environment variable access, and likely local file interaction, but it does not declare any explicit tool scope or permissions. For an automated trading skill, this creates unnecessary ambiguity about what the agent is allowed to access, increasing the risk of over-privileged execution, unintended secret exposure, or unsafe file/network operations if the runtime grants broad defaults.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · news_events.py (reported line 87)May include surrounding context.

python
"cnbc_top": {"url": "https://search.cnbc.com/rs/search/combinedcms/view.xml?partnerId=wrss01&id=100003114", "tier": 2},
    "marketwatch": {"url": "https://feeds.marketwatch.com/marketwatch/topstories/", "tier": 2},
    "politico": {"url": "https://www.politico.com/rss/politicopicks.xml", "tier": 2},
    "axios": {"url": "https://api.axios.com/feed/", "tier": 2},
    "thehill": {"url": "https://thehill.com/feed/", "tier": 2},
    "ft": {"url": "https://www.ft.com/rss/home", "tier": 2},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

When run with --live, the skill submits real trades immediately based on automated RSS parsing and heuristic matching, without any explicit confirmation, approval gate, or secondary validation. In a trading skill, this is materially risky because noisy, spoofed, misclassified, or simply incorrect news stories can directly trigger financial actions and losses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.