automated agentic perps trading on dex.clutch.market

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:50 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Clutch Perps trading assistant with approval gates, but users should treat its unpinned external MCP install as a supply-chain risk.

Before installing, verify the npm package and repository, prefer an exact reviewed version instead of @latest, and run it without administrator privileges. Do not approve trade execution unless the broker, venue, size, leverage, TP/SL, and risk cap match your intent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Third-Party npm Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-64
Vulnerability Type: Unpinned remote npm dependency execution
Risk Level: Medium

The installation workflow instructs users to execute an npm package without pinning it to a reviewed version. The manual fallback explicitly selects the mutable latest release.

bash

npx @clutchmarkets/mcp-server init --client <your-client>

json

{
  "mcpServers": {
    "clutch": {
      "command": "npx",
      "args": ["@clutchmarkets/mcp-server@latest"]
    }
  }
}

Technical Analysis

npx downloads and executes third-party package code with the privileges of the invoking user. Because neither workflow pins the package to an exact reviewed version or verifies an integrity digest, the code executed may differ from the code that was present when the Skill was audited.

The explicit use of @latest makes the fallback configuration persistently dependent on whichever release the package registry currently designates as latest. Provenance links, optional metadata inspection commands, and the documented consent prompt improve transparency but do not establish package integrity or prevent execution of a compromised future release.

Attack Path

1. An attacker compromises the npm publisher account, the package release process, or a transitive dependency.
2. The attacker publishes a malicious release of @clutchmarkets/mcp-server.
3. npm resolves the unversioned package or the explicit @latest selector to that release.
4. A user follows the Skill's installation instructions or starts the configured MCP server.
5. npx downloads and executes the malicious package under the user's local account.
6. The package can perform actions available to that account before the user can meaningfully inspect its runtime behavior.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user runn ...[truncated 387 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact, reviewed version in every command and configuration:

   bash

   npx --yes @clutchmarkets/mcp-server@<exact-reviewed-version> init --client <your-client>
   

2. Replace @latest in the manual configuration with the same exact reviewed version.
3. Record and verify the expected package integrity digest or signed provenance before execution.
4. Establish an explicit dependency-upgrade process that reviews release changes and dependencies before changing the pinned version.
5. Recommend running the package with least privilege and without administrator or root permissions.
6. Preserve the existing explicit-consent requirement, but clearly state that consent does not replace version pinning and integrity verification.
7. Where practical, download and inspect the package artifact before execution or use a trusted lockfile and controlled package registry.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill when users ask for 'setup, live trade workflows, market checks, order planning, risk setup, or execution,' which is a wide set of natural-language triggers and does not provide negative examples or tighter activation constraints. Terms like 'market checks' and 'setup' are broad enough to overlap with general finance conversations, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx @clutchmarkets/mcp-server without pinning an exact version, which causes retrieval and execution of whatever package version is current at run time. In a trading skill that explicitly acknowledges npx as remote code execution, this materially increases supply-chain risk: a compromised maintainer account, malicious update, or poisoned latest release could execute arbitrary code on the user's machine before any trading workflow begins.

Content

No source excerpt is available for this finding.