ClawHub
Back to skill

Security audit

simmer-wallet-setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for wallet setup, but it asks users to install mutable third-party code and use wallet credentials in a real-money trading workflow with some automatic trade side effects.

Review this before installing if the runtime will hold real wallet keys or API keys. Prefer an isolated environment, avoid curl-to-bash installers, install pinned and verified SDK versions where possible, keep wallet keys unset during package installation, and make sure you understand that some SDK calls can sign approvals or trigger configured exit trades.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:46
Finding

Unverified Remote Installer Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 46
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://docs.openwallet.sh/install.sh | bash   # one-time OWS install

Technical Analysis

The instruction downloads a mutable script from an external server and immediately passes its contents to Bash. There is no version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded artifact before execution.

TLS protects the connection in transit but does not protect against compromise of the hosting server, publication account, DNS infrastructure, or upstream release process. Because the effective payload is controlled remotely, it can change after this Skill has been reviewed.

OWS is described as an optional key store. Executing an unrestricted remote shell script is therefore not the minimum privilege necessary to configure the Skill or protect a wallet key.

Attack Path

  1. An attacker compromises docs.openwallet.sh, its deployment credentials, DNS, or another part of its distribution infrastructure.
  2. The attacker modifies install.sh to include credential theft, persistence, tool replacement, or other hostile commands.
  3. A user follows the documented installation command.
  4. curl retrieves the attacker-controlled response and sends it directly to Bash.
  5. Bash executes the payload with all permissions available to the invoking user.
  6. The payload can inspect the environment or modify wallet-related tooling before the user imports or uses a real-money wallet.

Impact Assessment

The remote payload receives arbitrary code execution under the invoking user's account. Subject to that account's permissions, it could:

  • Read accessible files and environment variables, including SIMMER_API_KEY or a currently exported WALLET_PRIVATE_KEY.
  • Modify shell ...[truncated 494 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | bash pipeline.
  • Pin OWS to a reviewed, immutable release version.
  • Download the installer or release artifact as a separate step.
  • Publish and verify a SHA-256 checksum and, preferably, a signature tied to a documented publisher key.
  • Present the downloaded artifact for inspection before execution.
  • Use a trusted package manager where possible and require package signature verification.
  • Execute installation as an unprivileged user in an isolated environment.
  • Ensure wallet private keys and API keys are unset while installing software.
  • Document the files, network access, and permissions required by the installer so users can enforce least privilege.

A safer workflow should follow this pattern:

bash
curl -fL -o ows-installer.sh "https://trusted.example/immutable-release/ows-installer.sh"
sha256sum --check ows-installer.sha256
less ows-installer.sh
bash ows-installer.sh

The release URL and expected checksum must be immutable and independently authenticated.

T08 · Insecure Dependencies

Error
Location
SKILL.md:47
Finding

Unpinned Third-Party Packages Installed in a Wallet-Sensitive Environment

Content
View full analysis

Vulnerability Details

File Locations: SKILL.md, lines 47 and 130; clawhub.json, lines 8–10
Vulnerability Type: Insecure dependency and supply-chain configuration
Risk Level: High

Vulnerable Code in SKILL.md:

bash
pip install 'simmer-sdk[ows]'
bash
pip install simmer-sdk          # add [ows] extra if using the OWS key store

Vulnerable Configuration in clawhub.json:

json
"pip": [
  "simmer-sdk"
]

Technical Analysis

The Skill installs simmer-sdk and its optional OWS dependencies without pinning exact versions or verifying artifact hashes. Dependency resolution can consequently select a different package release or transitive dependency each time the instructions are followed.

Python package installation may execute build-system hooks for source distributions. Installed package code is subsequently imported into a process that accesses SIMMER_API_KEY, WALLET_PRIVATE_KEY, or an OWS wallet and performs signing, approval, credential derivation, and transaction operations.

The external SDK implementation and its transitive dependencies are not included in this project. Claims that private keys remain local and that transactions are constructed safely therefore cannot be verified from the audited files.

Attack Path

  1. An attacker compromises the publisher account, package repository, a future SDK release, or a transitive dependency.
  2. The unpinned installation resolves to the compromised release.
  3. Malicious code executes during package installation or when simmer_sdk is imported.
  4. The package runs in the same user context as the wallet setup process.
  5. It reads available API credentials or private-key material, manipulates generated signing requests, substitutes transaction destinations, or misuses approval functionality.
  6. Stolen credentials or maliciously signed transactions are used to access the trading account or wallet assets.

...[truncated 873 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin simmer-sdk and every security-sensitive optional dependency to reviewed exact versions.
  • Generate a lock file containing all transitive dependencies.
  • Require package hashes, such as with pip install --require-hashes -r requirements.txt.
  • Prefer prebuilt, signed wheels from a trusted repository and reject unexpected source distributions.
  • Audit the SDK, OWS integration, and their transitive dependencies before allowing access to wallet secrets.
  • Install dependencies in a dedicated virtual environment while wallet and API environment variables are unset.
  • Separate installation from wallet operation so package build hooks never execute in a credential-bearing process.
  • Use an allowlisted internal package mirror where practical.
  • Add automated dependency scanning and verify publisher and release provenance during updates.
  • Update clawhub.json so its dependency declaration is version-constrained consistently with the reviewed lock file.

An appropriate installation mechanism should use a fully resolved requirements file, for example:

bash
python -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.lock

The lock file should contain exact versions and verified hashes for the SDK and all transitive dependencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to run curl ... | bash, which executes a remotely fetched script without prior inspection or integrity verification. If the remote host, DNS, TLS chain, or distribution pipeline is compromised, users may execute attacker-controlled code on the agent host, potentially leading to wallet/key theft and full system compromise.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

text
- **Prefer a key store over a bare env var.** [OWS](https://openwallet.sh) (Open Wallet Standard) keeps the key encrypted at rest (AES-256-GCM); the SDK picks it up via `OWS_WALLET` and signs through the vault. Its policy engine can scope the agent's signing token to Polymarket orders only.
  ```bash
  curl -fsSL https://docs.openwallet.sh/install.sh | bash   # one-time OWS install
  pip install 'simmer-sdk[ows]'
  ows wallet import --name "my-agent-wallet" --private-key "$WALLET_PRIVATE_KEY"
  unset WALLET_PRIVATE_KEY

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md
- **"External wallet requires a pre-signed order"** → key not configured. Confirm `WALLET_PRIVATE_KEY` is set — or, for an OWS key store, `ows wallet list` to verify the wallet exists and `OWS_WALLET` is set.
- **"insufficient allowance"** → set approvals once per wallet: `client.activate_polymarket_dw(agent_id=...)` for a per-agent deposit wallet, `client.activate_polymarket_dw()` for a user-primary deposit wallet, or `client.set_approvals()` for a legacy raw-key EOA wallet.
- **Balance shows $0 but funds visible elsewhere** → check chain (Polygon vs Solana) and token (pUSD vs USDC.e). See dashboard migration tool for V2 conversion.
- **API key format wrong / 401 with a key that "looks set"** → inspect the raw value: `printenv SIMMER_API_KEY | cut -c1-20`. Must start with `sk_live_`. A common silent failure: install commands that use `pbpaste` or similar clipboard-read primitives write the *install command text itself* as the key value when the user copies the command after copying the key. Fix: get a fresh key from simmer.markets/dashboard, then `export SIMMER_API_KEY="sk_live_..."` (type/paste the key directly, never pipe from clipboard into the variable assignment).

## Links

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
| **[Import a Polymarket wallet](#path-b--import-a-polymarket-wallet)** | Same local signing — key exported from polymarket.com | Fund with card/exchange via Polymarket's onramps; the wallet arrives at Simmer already funded and approved. |
| **[Connect existing agent](#connect-existing-agent)** | Same local signing, wallet already registered in the dashboard | You already activated a dedicated per-agent wallet in the dashboard and want to wire your runtime to it. |

> **Already on a managed wallet?** You don't need this skill — managed setup is a dashboard flow, not an agent task. Open [simmer.markets/dashboard](https://simmer.markets/dashboard?ref=sdk-skill&utm_campaign=sdk-skill), go to your agent's **Wallet** tab, and click **Fund & activate trading**. The wizard opens a multi-chain bridge that accepts USDC, USDT, or USDC.e on Ethereum / Polygon / Base / Arbitrum / Solana — funds land as pUSD on your Polymarket Deposit Wallet, contracts auto-approve. **Do not tell the user to send funds directly to their agent wallet's EOA expecting them to sweep** — only legacy USDC.e on Polygon is recognized on the direct path; native USDC, USDT, and cross-chain tokens must go through the bridge wizard.

## Key safety (read this first)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The skill states that the SDK auto-executes pending exits each get_briefing() cycle, which means routine briefing/polling can trigger real-money trade actions. Even if intended as a stop-loss/take-profit safety feature, coupling read-like operations with order execution increases the risk of unintended trades, surprise side effects, and abuse if an agent or operator invokes get_briefing() without realizing it has transactional consequences.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
## Risk monitor

The auto risk monitor (stop-loss, take-profit) is configured at simmer.markets/dashboard → Settings → Auto Risk Monitor. The SDK auto-executes pending exits each `get_briefing()` cycle. The agent must be running.

## Troubleshooting

Static analysis

No suspicious patterns detected.