Preflight Stage.MnOQOP

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 9:01 AM UTC
• Version: 0.3.6

Overview

This skill performs a disclosed read-only trading preflight check, with a dependency-pinning caution but no evidence of hidden or destructive behavior.

Before installing, treat SIMMER_API_KEY as sensitive and prefer a least-privileged read-only key if available. Avoid writing full JSON preflight output to broadly accessible logs because it can include wallet, balance, exposure, and risk information. For higher-assurance deployments, pin simmer-sdk to a reviewed version or use a locked requirements file with hashes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:8

Finding

Unbounded Third-Party SDK Version Exposes API Credentials to Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:8-10 (dependency declaration); related privileged use at preflight.py:64-101
Vulnerability Type: Unpinned third-party dependency with access to sensitive credentials
Risk Level: Medium

Vulnerable Code

clawhub.json:8-10:

json

"pip": [
  "simmer-sdk>=0.17.13"
]

The dependency is imported and given the API credential in preflight.py:64-101:

python

api_key = os.environ.get("SIMMER_API_KEY")
if not api_key:
    print("ERROR: SIMMER_API_KEY not set", file=sys.stderr)
    return 2

try:
    import simmer_sdk as _sdk_mod
    from simmer_sdk import SimmerClient
except ImportError:
    print(
        f"ERROR: simmer-sdk not installed — run: pip install 'simmer-sdk>={_SDK_MIN_VERSION}'",
        file=sys.stderr,
    )
    return 2

_installed_ver = getattr(_sdk_mod, "__version__", "")
if not _sdk_meets_floor(_installed_ver):
    print(
        f"ERROR: simmer-sdk {_installed_ver or '?'} is below the required >={_SDK_MIN_VERSION} "
        f"— run: pip install 'simmer-sdk>={_SDK_MIN_VERSION}'",
        file=sys.stderr,
    )
    return 2

try:
    client = SimmerClient.readonly(api_key=api_key, venue=_venue)
except ValueError as e:
    print(f"ERROR: {e}", file=sys.stderr)
    return 2

pf = client.preflight(
    venue=_venue,
    planned_amount=planned_amount,
    exposure_cap_usd=_cap,
)

Technical Analysis

The version constraint accepts version 0.17.13 and every later release. Consequently, installation at different times can resolve to different package code without any corresponding change to the reviewed Skill.

Python executes package-level code as soon as simmer_sdk is imported. The SDK then receives SIMMER_API_KEY directly through SimmerClient.readonly(). It operates in the same process as the Skill and is not sandboxed, so package code can access the pr ...[truncated 2362 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended requirement with an exact, reviewed version:

   json

   "pip": [
     "simmer-sdk==0.17.13"
   ]
   

2. Install from a hash-locked requirements file or equivalent lock mechanism, for example:

   text

   simmer-sdk==0.17.13 \
       --hash=sha256:REVIEWED_DISTRIBUTION_HASH
   

   Include hashes for all transitive dependencies as well.

3. Configure installation to use an explicitly trusted package index and disallow unexpected extra indexes. Preserve TLS certificate verification.

4. Review package source and release changes before updating the pinned version. Perform updates through a controlled pull request that refreshes both the version and verified hashes.

5. Run the Skill under a dedicated, minimally privileged operating-system account or container. Restrict readable files, inherited environment variables, and outbound destinations to those required by the Simmer API.

6. Provision the API key with the minimum server-side permissions required for read-only preflight operations, rotate it periodically, and revoke it immediately if dependency compromise is suspected.

7. Avoid writing full --json results to broadly accessible logs because they can include account identity, wallet addresses, balances, exposure, and risk alerts. Apply log access controls and retention limits.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.