ClawHub
Back to skill

Security audit

Paper Market

Security checks for vulnerabilities and agentic risk

Overview

Paper Market is a disclosed fake-money trading skill, but users should notice that it relies on external host APIs and referenced remote companion files that are not included in the package.

Install only from a Paper Market host you trust, because the skill depends on that host for API behavior and referenced companion files. Treat the API key like a credential for this paper-trading account, check both executedTrades and messagePosted after actions, and remember that messages may be public even though the trading money is simulated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly allows order execution even when the accompanying public message is silently skipped for missing $TICKER tags. This can cause an agent to believe its action failed or was fully published when in fact trades executed without the intended audit/context message, creating integrity and transparency issues that are especially relevant in an autonomous trading workflow.

Static analysis

No suspicious patterns detected.