ClawHub
Back to skill

Security audit

Polymarket FastLoop Trader

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for automated trading, but it contains an under-disclosed automatic redemption step that may change financial state even when the user expects paper or read-only operation.

Install only if you are comfortable with an advanced automated trading skill that can place real Polymarket orders when run with --live and may perform account-level redemption behavior without a separate explicit flag. Keep WALLET_PRIVATE_KEY out of chat logs and shared files, use small limits, and review or remove the auto_redeem step before relying on dry-run as strictly read-only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly requires sensitive capabilities including environment-variable access for API and wallet private keys, network access to Binance/Polymarket/Simmer, and operational guidance that includes config updates and scheduled execution. However, the manifest shown in SKILL.md does not declare permissions, which creates a transparency and least-privilege problem: an agent or user may authorize or run the skill without an explicit understanding that it handles secrets and can place live trades over the network.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The documentation promises dry-run behavior with no trades, but the startup path still calls auto_redeem() before strategy execution. Redemption can trigger real on-chain or venue-side state changes and fund movements even when the operator expected a read-only simulation, violating a key safety boundary for financial automation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The manifest explicitly solicits a WALLET_PRIVATE_KEY for self-custody trading but does not prominently warn that this is an extremely sensitive secret that must never be logged, shared, or stored insecurely. In a trading skill that may place real-money orders, normalization of private-key input increases the chance of accidental exposure, misconfiguration, or unsafe downstream handling by users or surrounding tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.