ClawHub
Back to skill

Security audit

Auto Trading Winner

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about being a trading automation tool, but it can place recurring unattended live trades with limited runtime controls.

Review this carefully before installing. Use dry-run/manual mode unless you deliberately want automated trading, avoid setting AUTO_CONFIRM_LIVE for real-money venues, keep trading credentials isolated, and add independent order limits plus pinned dependency versions before trusting recurring live execution.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:3
Finding

Unpinned Executable Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: clawhub.json:3-6, SKILL.md:133-149, and PUBLISHING.md:23-39
Vulnerability Type: Unpinned third-party dependencies and mutable CLI versions
Risk Level: Medium

The project installs simmer-sdk without a version constraint and instructs users to execute the mutable latest release of the ClawHub CLI.

json
"requires": {
  "pip": ["simmer-sdk"],
  "env": ["SIMMER_API_KEY"]
}
bash
npx clawhub@latest publish . --slug auto-trading-winner --version 1.0.0
bash
npx clawhub@latest install auto-trading-winner
bash
npx clawhub@latest publish . --slug auto-trading-winner --bump patch

Technical Analysis

The simmer-sdk requirement does not constrain the dependency to a reviewed version or verify its integrity with a cryptographic hash. A future installation can therefore resolve to code that differs from the version used during this audit.

The documented npx clawhub@latest commands explicitly download and execute whichever package release is currently tagged as latest. This makes the effective executable mutable after review. Although there is no evidence that either current package is malicious, compromise of a package publisher, registry account, or future release could introduce arbitrary code into the installation or publishing workflow.

These dependencies may execute in a process environment containing SIMMER_API_KEY and optional wallet private keys. The SDK also participates directly in market discovery, account access, and trade submission.

Attack Path

  1. An upstream publisher account, package registry entry, or future package release is compromised or becomes malicious.
  2. A user installs the skill or follows the publishing instructions.
  3. The package manager resolves the unconstrained simmer-sdk release or the mutable clawhub@latest release.
  4. The downloaded package executes with the invoking use ...[truncated 887 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin simmer-sdk to an exact, reviewed version rather than accepting any available release.
  2. Maintain a lockfile containing cryptographic hashes for all direct and transitive Python dependencies.
  3. Replace npx clawhub@latest with an exact reviewed version, such as npx clawhub@X.Y.Z.
  4. Use package-manager integrity verification and a trusted internal package mirror where feasible.
  5. Review dependency updates before adoption and run automated vulnerability and provenance checks in CI.
  6. Execute publishing and installation operations in an isolated environment without trading or wallet credentials unless they are strictly required.
  7. Rotate relevant credentials immediately if a dependency version is later identified as compromised.

T09 · Insecure Skill Coding Practices

Warning
Location
trade_skill.py:126
Finding

Live Trade Sizing Can Use a Fabricated Bankroll

Content
View full analysis

Vulnerability Details

File Location: trade_skill.py:126-143, with the value used for sizing at trade_skill.py:381-383 and execution at trade_skill.py:397-405
Vulnerability Type: Fail-open financial risk control
Risk Level: Medium

The balance retrieval function silently returns a hardcoded bankroll when neither account information source contains a recognized numeric balance:

python
def estimate_bankroll(client: SimmerClient, venue: str) -> float:
    briefing = client.get_briefing()
    venue_data = (briefing.get("venues") or {}).get(venue) or {}
    balance = venue_data.get("balance")
    if isinstance(balance, (int, float)):
        return float(balance)

    portfolio = client.get_portfolio(venue=venue)
    if isinstance(portfolio, dict):
        nested = portfolio.get(venue)
        if isinstance(nested, dict):
            nested_balance = nested.get("balance")
            if isinstance(nested_balance, (int, float)):
                return float(nested_balance)
        direct_balance = portfolio.get("balance")
        if isinstance(direct_balance, (int, float)):
            return float(direct_balance)

    return 10000.0 if venue == "sim" else 100.0

The resulting value is subsequently passed into position sizing:

python
amount = round(
    float(size_position(p_win=p_win, market_price=market_price, bankroll=bankroll, min_ev=config.min_edge)),
    2,
)

In live mode, the calculated amount is submitted to the configured venue:

python
result = client.trade(
    market_id=market_id,
    side=side,
    amount=amount,
    venue=config.venue,
    source=TRADE_SOURCE,
    skill_slug=SKILL_SLUG,
    reasoning=reasoning,
)

Technical Analysis

A bankroll is a security-sensitive financial control because it bounds position sizing. If both SDK responses omit the expected balance fields, use an unexpected schema, or return nonnumeric ...[truncated 2344 chars]

Remediation
View remediation

Remediation Suggestions

  1. Fail closed when a validated numeric balance cannot be retrieved for a real-money venue.
  2. Permit a fallback bankroll only for the sim venue, and clearly label it as simulated capital.
  3. If an operator-provided fallback is required, use a dedicated configuration variable and reject it for live venues unless explicitly confirmed.
  4. Validate that the retrieved balance is finite, nonnegative, and within expected venue-specific bounds.
  5. Add an independent MAX_TRADE_AMOUNT limit and cap every calculated position before order submission.
  6. Add a maximum percentage-of-bankroll constraint independent of the SDK sizing result.
  7. Re-fetch and validate account balance immediately before a live trade where supported.
  8. Log balance retrieval failures distinctly rather than silently substituting a value.
  9. Add tests covering absent fields, schema changes, strings, NaN, infinity, negative balances, and API errors.
  10. For managed automatic execution, stop the run and alert the operator whenever bankroll verification fails.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
- `SKILL.md`

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The publishing command uses npx clawhub@latest, which fetches and executes the most recent package version at runtime rather than a reviewed, fixed version. In a trading-related skill, this creates a meaningful supply-chain risk: if the package or one of its transitive dependencies is compromised, an operator could execute attacker-controlled code during publish/install workflows with access to local files, environment variables, and trading credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The install instruction again uses npx clawhub@latest, causing users to execute whatever package version is current at install time. Because this skill handles publishing and installation in an ecosystem tied to trading automation, compromise of the package path could lead to credential theft, malicious skill installation, or tampering with deployment artifacts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The update workflow uses npx clawhub@latest before publishing a new version, which introduces the same unpinned remote-code-execution risk into the release process. In this context, the danger is elevated because the repository includes references to API keys and live trading credentials; a malicious package update could exfiltrate secrets or alter published skill contents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares environment-variable usage, including sensitive credentials, but does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, missing scope metadata can cause the runtime or user to grant broader access than intended, increasing the chance that secrets are exposed to code paths or integrations that were not clearly disclosed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description broadly describes a 'Cross-venue trading skill' with unattended auto mode but does not define specific trigger phrases, invocation boundaries, or exclusion conditions. For a markdown/manifest file, this can create ambiguity about when the skill should be invoked versus ordinary discussion of trading or market scanning.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The skill explicitly supports non-interactive candidate selection and live execution controls through environment variables, enabling automated financial decision-making. In the context of a trading skill with credentialed exchange access, autonomous execution can cause unintended trades, loss of funds, or rapid propagation of strategy errors without a human review step.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
- `MAX_SLIPPAGE_PCT`: Skip trades if estimated slippage exceeds this threshold. Default: `0.15`
- `SIMMER_ENABLE_LIVE`: Set to `true` to allow live order placement. Default: `false`
- `SELECT_CANDIDATE`: Optional 1-based index of the candidate to trade in non-interactive runs.
- `AUTO_CONFIRM_LIVE`: Optional explicit override required if you want `RUN_MODE=auto` together with live execution on `kalshi` or `polymarket`. Default: `false`

## Safety Model

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The safety model states that in auto mode the skill starts from the top-ranked candidate and automatically falls through to later ranked candidates if checks fail, with explicit support for unattended live execution on some venues. In a financial trading context, this materially increases risk because the system can continue making autonomous trade choices across multiple opportunities without human validation, amplifying losses from bad ranking logic, stale data, or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- Kalshi markets use Simmer's check-then-import indexing path before trading.
- `RUN_MODE=manual` is the default for all venues.
- `RUN_MODE=auto` makes the skill non-interactive and starts from the top-ranked candidate.
- Automatic live execution on `kalshi` and `polymarket` requires an explicit `AUTO_CONFIRM_LIVE=true` override.
- If the selected candidate fails, the skill tries later ranked candidates automatically.

## Local Usage

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The publishing command uses npx clawhub@latest, which fetches and executes the newest package version at runtime instead of a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during install or publish workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The install verification step invokes npx clawhub@latest, which executes whatever package version is current at the time of use. Because installation is a high-trust action often performed by end users, this magnifies supply-chain exposure and could lead to arbitrary code execution if the package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The patch-publish command again relies on npx clawhub@latest, introducing the same unpinned remote execution risk into the release path. Since release workflows may run with repository credentials or publishing privileges, compromise here can have downstream impact on distributed artifacts and users.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The skill supports autonomous decision-making through auto mode and an explicit AUTO_CONFIRM_LIVE override for live execution on real trading venues. In a financial-trading context, allowing the agent to select and execute trades without an interactive approval step can directly lead to monetary loss if configuration is wrong, market conditions change, or the logic misfires.

Content

Scanner excerpt · clawhub.json (reported line 85)May include surrounding context.

json
"description": "Optional 1-based candidate index to trade in non-interactive runs."
    },
    {
      "name": "AUTO_CONFIRM_LIVE",
      "required": false,
      "description": "Explicit override for auto mode with live execution on kalshi or polymarket. Default: false."
    }

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest schedules the skill to run every 30 minutes, and this skill is explicitly designed for unattended trading. In the context of a trading agent that can place live orders when environment flags are enabled, broad periodic execution increases the chance of unintended or repeated financial actions without a narrow event trigger or explicit per-run user approval.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · trade_skill.py (reported line 30)May include surrounding context.

python
max_slippage_pct: float
    live: bool
    selected_candidate: Optional[int]
    auto_confirm_live: bool


def parse_args() -> argparse.Namespace:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · trade_skill.py (reported line 107)May include surrounding context.

python
max_slippage_pct: float
    live: bool
    selected_candidate: Optional[int]
    auto_confirm_live: bool


def parse_args() -> argparse.Namespace:

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · trade_skill.py (reported line 107)May include surrounding context.

python
max_slippage_pct=max_slippage_pct,
        live=live,
        selected_candidate=maybe_int("SELECT_CANDIDATE"),
        auto_confirm_live=getenv_bool("AUTO_CONFIRM_LIVE", False),
    )

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · trade_skill.py (reported line 311)May include surrounding context.

python
max_slippage_pct=max_slippage_pct,
        live=live,
        selected_candidate=maybe_int("SELECT_CANDIDATE"),
        auto_confirm_live=getenv_bool("AUTO_CONFIRM_LIVE", False),
    )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill performs client.auto_redeem() on every run, but the description only advertises market filtering and trading behavior. In a financial skill, undisclosed redemption changes account state and can liquidate or settle positions unexpectedly, making this a dangerous hidden side effect rather than a harmless documentation mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code can import Kalshi markets into the platform during execution, which is more than passive cross-venue trading and materially changes external/system state. In this context, hidden import/indexing behavior may create unexpected listings, broaden attack surface, or cause operators to act on markets they did not intend to onboard.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The validation logic explicitly allows autonomous live trading on non-sim venues whenever AUTO_CONFIRM_LIVE is set, which substitutes a static config bit for real user authorization. In the context of a trading skill handling real-money venues, autonomous execution materially increases the chance of unauthorized or accidental trades and direct financial loss.

Content

Scanner excerpt · trade_skill.py (reported line 308)May include surrounding context.

python
def validate_execution_mode(config: Config) -> None:
    if config.live and config.run_mode == "auto" and config.venue != "sim" and not config.auto_confirm_live:
        raise RuntimeError(
            "Automatic live execution is disabled for real-money venues. "
            "Use RUN_MODE=manual, or keep RUN_MODE=auto with dry-run, or explicitly set AUTO_CONFIRM_LIVE=true."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill permits unattended live trading on real-money venues when AUTO_CONFIRM_LIVE=true, without any interactive confirmation or stronger approval control at execution time. In a trading skill, this creates a clear path to unintended financial transactions from misconfiguration, automation abuse, or malicious environment manipulation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest hard-codes recurring automated execution without any user opt-in context in the file itself. While the presence of flags like SIMMER_ENABLE_LIVE and AUTO_CONFIRM_LIVE reduces immediacy, a default scheduler on a trading skill still creates risk of users deploying automation they did not fully intend or understand.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argument parser description says 'Cross-venue manual-selection trading skill,' which contradicts the manifest and actual implementation supporting RUN_MODE=auto and automatic candidate selection. This is an intent-level mismatch in user-facing documentation about what the skill does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This inline documentation actively narrows the skill to manual selection, while later logic explicitly accepts RUN_MODE='auto' and auto-selects a candidate for unattended execution. That is a direct contradiction between documentation and implemented behavior.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · trade_skill.py (reported line 121)May include surrounding context.

python
def read_value(item: Any, key: str, default: Any = None) -> Any:
    if isinstance(item, dict):
        return item.get(key, default)
    return getattr(item, key, default)


def format_probability(value: float) -> str:

Static analysis

No suspicious patterns detected.