Security audit

Mert Sniper

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it needs Review because its live-money trading behavior and platform defaults do not line up cleanly with its documentation.

Review before installing or running live. Confirm the intended trade direction, fix the ClawHub tunable defaults/ranges to match the documented safeguards, and only provide wallet credentials after testing paper mode and understanding that --live can place real irreversible orders and redeem positions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The top-level description says the strategy trades against the under-priced side, but later sections state it buys the favored/higher-probability side. In a live trading skill, this contradiction can cause users or agents to deploy capital under a false understanding of the strategy, materially changing risk, expected edge, and loss behavior.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The workflow section reinforces behavior that conflicts with the earlier strategy description, creating a second source of truth inside the same skill. This increases the chance that a user, auditor, or downstream agent will act on the wrong assumption and execute unintended real-money trades, especially because the skill supports `--live` execution with wallet-based order signing.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill description promises trades against the under-priced side, but the implementation selects the favorite whenever the probability split exceeds the threshold. In an autonomous trading agent, this kind of strategy/implementation mismatch is dangerous because operators may deploy it under false assumptions, causing systematic real-money trades opposite to the intended risk thesis.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The module-level documentation states the bot places bounded trades against the under-priced side, but the trading logic later backs the favorite. This is a security-relevant integrity issue because it can mislead users, reviewers, or orchestrators into authorizing live trading behavior they did not intend to run.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script is materially inconsistent with the declared skill purpose: instead of Polymarket near-expiry trading logic, it authenticates to and queries a different service, Simmer, for account portfolio data. In an agent skill context, undeclared access to financial account information is dangerous because users may grant or set credentials expecting one platform and behavior, while the code inspects another account surface entirely.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code performs portfolio and positions inspection that is not justified by the stated Polymarket sniper purpose, expanding access to sensitive financial data beyond user expectations. Even though it appears read-only, gathering balances, exposure, and positions can leak trading strategy and account state in logs or agent outputs.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The module and CLI self-identify as a Simmer account status tool, directly contradicting the manifest's Polymarket trading description. This kind of capability mismatch is dangerous in security review because it can conceal undeclared behavior, causing users or orchestration systems to run code with access patterns they did not intend to permit.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.