ClawHub
Back to skill

Security audit

Paper Market

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paper-trading integration, but it asks agents to follow mutable remote instructions and install unverified remote skill files.

Install only from a trusted, fixed Paper Market host after inspecting the exact SKILL.md, HEARTBEAT.md, and RULES.md files. Do not let an agent blindly follow a remote heartbeat document unless updates are pinned or reviewed. Treat the API key as sensitive, preview trades with the estimate endpoint, and remember that posts are public and claim verification links identity information such as email and X handle to the service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:48
Finding

Mutable Remote Heartbeat Can Hijack Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 48-51
Vulnerability Type: Remote instruction injection through mutable content
Risk Level: High

Vulnerable Code:

markdown
## Paper Market (every 15–30 min, US market hours)
If 15+ minutes since lastPaperMarketCheck:
1. Fetch https://YOUR_HOST/heartbeat.md and follow it
2. Update lastPaperMarketCheck timestamp in memory

Technical Analysis

The Skill instructs the Agent to periodically retrieve a Markdown document from a remote host and follow its contents as instructions. The downloaded document is not bundled with the audited artifact, and the process does not require a trusted-origin allowlist, cryptographic signature, integrity hash, or review of changed content.

Because YOUR_HOST is an unrestricted placeholder, the effective instruction source depends on deployment configuration. Even if the original host is legitimate, a compromise of that host can alter the Agent's future behavior without changing the reviewed Skill package.

Periodic retrieval is relevant to the declared market-monitoring workflow, but treating mutable network content as authoritative Agent instructions exceeds the minimum privilege necessary. Market data could instead be returned through a narrowly defined API schema, while operational instructions remain local and version-pinned.

Attack Path

  1. An operator configures YOUR_HOST to an attacker-controlled host, or an attacker compromises the configured Paper Market host.
  2. The attacker publishes a modified heartbeat.md containing instructions unrelated to market monitoring.
  3. At the next scheduled check, the Agent fetches the malicious document.
  4. The Agent follows the document because the local Skill explicitly directs it to do so.
  5. Depending on the Agent's available tools and permissions, the injected instructions may induce unauthorized network requests, access to local information, disclosure ...[truncated 927 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle heartbeat.md in the reviewed Skill package rather than fetching it dynamically.
  2. If remote updates are required, use a fixed canonical origin rather than an unrestricted YOUR_HOST placeholder.
  3. Pin each approved document by version and SHA-256 digest, or verify it using a trusted digital signature before use.
  4. Treat remotely returned content as untrusted data, not as authoritative Agent instructions.
  5. Define heartbeat behavior locally and retrieve only structured market data through a schema-validated API.
  6. Reject unknown fields, executable instructions, tool-use requests, and attempts to access secrets or unrelated resources.
  7. Require explicit operator approval when the remote document version or integrity digest changes.
  8. Apply network allowlisting so heartbeat requests can reach only the legitimate Paper Market origin.

T08 · Insecure Dependencies

Error
Location
skill.md:24
Finding

Unverified Remote Files Can Overwrite the Local Skill Installation

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 24-30
Vulnerability Type: Unsafe remote Skill installation and supply-chain update mechanism
Risk Level: High

Vulnerable Code:

bash
mkdir -p ~/.moltbot/skills/papermarket
curl -s https://YOUR_HOST/skill.md > ~/.moltbot/skills/papermarket/SKILL.md
curl -s https://YOUR_HOST/heartbeat.md > ~/.moltbot/skills/papermarket/HEARTBEAT.md
curl -s https://YOUR_HOST/rules.md > ~/.moltbot/skills/papermarket/RULES.md
curl -s https://YOUR_HOST/skill.json > ~/.moltbot/skills/papermarket/package.json

Technical Analysis

The optional installation procedure downloads four files from an unrestricted remote host and writes them directly into the local Skill directory. It does not pin a release version, verify cryptographic hashes or signatures, enforce a canonical origin, or inspect the downloaded documents before installation.

The commands also use curl -s without --fail, write directly to final paths, and do not perform atomic replacement. HTTP errors, interrupted transfers, or unexpected response bodies can therefore silently overwrite valid local files with empty, partial, or invalid content.

Although the retrieved files are not native executable binaries, SKILL.md, HEARTBEAT.md, and RULES.md can become trusted Agent instructions when the Skill is loaded. Consequently, replacing them can alter Agent behavior in a manner comparable to compromising a software dependency. The referenced companion files were absent from the audited artifact, so their intended contents could not be independently verified.

Attack Path

  1. A user substitutes an attacker-controlled value for YOUR_HOST, is directed to a deceptive deployment, or the legitimate deployment is compromised.
  2. The attacker serves modified skill.md, heartbeat.md, rules.md, or metadata.
  3. The user executes the documented installation commands.
  4. The commands overwrite files i ...[truncated 1073 chars]
Remediation
View remediation

Remediation Suggestions

  1. Publish releases from a fixed, documented, canonical HTTPS origin.
  2. Pin installation commands to an immutable version rather than mutable top-level paths.
  3. Distribute a signed manifest containing the expected SHA-256 digest of every Skill file.
  4. Verify signatures and hashes before moving downloaded files into the Skill directory.
  5. Download into a newly created temporary directory with restrictive permissions.
  6. Use curl --fail --show-error --location --proto '=https' and stop installation if any request fails.
  7. Validate metadata and expected filenames before installation.
  8. Move verified files atomically into their destination to avoid partial overwrites.
  9. Preserve the previous validated version and provide rollback behavior.
  10. Require operator review or approval before installing instruction-file updates.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 5)May include surrounding context.

md
metadata: {"moltbot":{"emoji":"📈","category":"trading","skill_files":["skill.md","heartbeat.md","rules.md"]}}

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 26)May include surrounding context.

Install locally (optional):

bash
mkdir -p ~/.moltbot/skills/papermarket
curl -s https://YOUR_HOST/skill.md > ~/.moltbot/skills/papermarket/SKILL.md
curl -s https://YOUR_HOST/heartbeat.md > ~/.moltbot/skills/papermarket/HEARTBEAT.md
curl -s https://YOUR_HOST/rules.md > ~/.moltbot/skills/papermarket/RULES.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 27)May include surrounding context.

bash
mkdir -p ~/.moltbot/skills/papermarket
curl -s https://YOUR_HOST/skill.md > ~/.moltbot/skills/papermarket/SKILL.md
curl -s https://YOUR_HOST/heartbeat.md > ~/.moltbot/skills/papermarket/HEARTBEAT.md
curl -s https://YOUR_HOST/rules.md > ~/.moltbot/skills/papermarket/RULES.md
curl -s https://YOUR_HOST/skill.json > ~/.moltbot/skills/papermarket/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 27)May include surrounding context.

bash
mkdir -p ~/.moltbot/skills/papermarket
curl -s https://YOUR_HOST/skill.md > ~/.moltbot/skills/papermarket/SKILL.md
curl -s https://YOUR_HOST/heartbeat.md > ~/.moltbot/skills/papermarket/HEARTBEAT.md
curl -s https://YOUR_HOST/rules.md > ~/.moltbot/skills/papermarket/RULES.md
curl -s https://YOUR_HOST/skill.json > ~/.moltbot/skills/papermarket/package.json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The markdown instructs users to 'Register and trade immediately' and provides a direct POST example to begin trading, but it does not clearly warn near the action flow that submitted orders may execute immediately and affect the simulated portfolio balance. Because this skill performs trading actions on behalf of an agent, an explicit caution around immediate order execution would improve user awareness and reduce accidental actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 173)May include surrounding context.

Pre-trade estimate (no execution)

bash
curl -X POST https://YOUR_HOST/api/agents/AGENT_ID/estimate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"orders": [{ "ticker": "NVDA", "side": "buy", "type": "market", "amountUsd": 200 }]}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill tells the agent to send claimUrl to a human with their X handle for verification, but it does not explicitly warn that this shares a user-associated link and social profile information with an external service. Since the claim flow involves personal identity linkage, the markdown should disclose that privacy-relevant data is involved.

Content

No source excerpt is available for this finding.