Polymarket Worldcup Watcher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 2.0.0

Overview

This skill is a straightforward Polymarket odds monitor, with disclosed Telegram alerts and no artifact evidence of hidden or destructive behavior.

Before installing, confirm the package source and version in ClawHub, use a private Telegram bot/chat if alerts reveal trading interests, and avoid granting broader filesystem, credential, or account permissions than the monitor needs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned External Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-48
Vulnerability Type: Unverified and mutable third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

clawhub install polymarket-worldcup-watcher
openclaw run polymarket-worldcup-watcher

Technical Analysis

The installation instructions retrieve and execute the polymarket-worldcup-watcher package without specifying an immutable version, integrity digest, verified publisher identity, digital signature, or trusted registry endpoint. The project contains only SKILL.md; therefore, the package that implements the advertised functionality is not available in the audited artifact.

This creates a supply-chain risk because the effective runtime payload can differ from the content reviewed here and can change after the audit. Compromise of the package publisher, registry, distribution channel, or mutable package release could cause users to install and execute attacker-controlled content.

No malicious implementation was found in SKILL.md itself. The risk arises from trusting and executing an external, unpinned dependency whose behavior cannot be verified from the supplied project.

Attack Path

1. An attacker compromises the package publisher account, registry entry, or another part of the package distribution channel.
2. The attacker replaces or updates the mutable polymarket-worldcup-watcher package with a malicious payload.
3. A user follows the documented clawhub install polymarket-worldcup-watcher instruction.
4. Because no version, digest, or signature is verified, the modified package is installed.
5. The user invokes openclaw run polymarket-worldcup-watcher.
6. The substituted payload executes with whatever tools, files, credentials, network access, and operating-system permissions are available to the OpenClaw runtime.

Impact Assessment

Successful exploitation could allow attacker-contr ...[truncated 603 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable, reviewed version rather than installing by an unversioned package name.
2. Pin and verify a cryptographic digest for the resolved package contents before execution.
3. Require signed releases and verify the publisher identity and signature through a trusted mechanism.
4. Explicitly document the expected registry, repository, publisher, and source-code location.
5. Include the implementation and dependency lockfile in the auditable project artifact whenever possible.
6. Review the complete resolved package, including scripts and transitive dependencies, before installation or execution.
7. Run the package in a least-privilege sandbox with narrowly scoped filesystem, network, credential, and tool access.
8. Disable or require approval for package installation lifecycle hooks and other automatic code-execution mechanisms.
9. Establish controlled update procedures so new package versions undergo security review before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises Telegram channel/group alert delivery but does not warn users that monitoring outputs and possibly metadata will be transmitted to a third-party platform. This creates a privacy and operational security risk, especially for trading or arbitrage users whose watchlists, timing, and alert content may reveal strategies or account interests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

All user-facing metadata and documentation in the skill file are written in Chinese, and there is no indication that the skill supports other languages or that Chinese is a justified region-specific requirement. This can violate language/locale policy where user-facing skills should not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.