ClawHub
Back to skill

Security audit

Moltmarkets Trader

Security checks across malware telemetry and agentic risk

Overview

The skill matches its MoltMarkets trading purpose, but it can use a local API key to make live bets, create markets, and resolve markets without built-in confirmations.

Review before installing on any real or funded MoltMarkets account. Use a test or least-privilege API key, require human approval outside the skill before any bet, market creation, seed bet, or resolution, and avoid create-market-with-odds.sh until its confirmation flow and argument handling are fixed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to run multiple shell scripts and access a local secret (`~/secrets/moltmarkets-api-key`), but it declares no permissions or capability boundaries. This creates an authorization gap where a caller may trigger shell-based actions and secret-backed API operations without the skill clearly advertising or constraining those powers.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The manifest describes MoltMarkets trading functions, but the body also directs scanning external services such as Polymarket, Kalshi, and Manifold for ideas. This mismatch can cause users or upstream policy systems to underestimate the skill's data access and behavioral scope, enabling unexpected outbound requests and decision-making based on undeclared sources.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger text says the skill activates on essentially any MoltMarkets trading, prediction market analysis, or forecasting task, which is broad enough to capture ordinary analytical requests. In a skill that can execute trades and resolve markets, overbroad triggering raises the chance of accidental invocation of financially sensitive actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This script performs authenticated, account-impacting actions against a live trading API and immediately places a real bet without any interactive confirmation, dry-run mode, or explicit safety gate. In the context of a prediction-market trading skill, this makes accidental invocation dangerous because it can create markets and spend funds from the user's account with a single command.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The script reads a live API key from a fixed path on disk with no prior disclosure or prompt, which can surprise users and cause unintended use of privileged credentials. While it does not itself exfiltrate the key, it silently couples local secret access with immediate network trading actions, increasing the chance of unintended authenticated operations.

Missing User Warnings

Medium
Confidence
73% confidence
Finding
The script automatically reads a long-lived API key from a local secrets file with no prompting or disclosure, enabling authenticated actions and access whenever the script is run. In an agent-skill context, silent use of stored credentials is risky because users may not realize a skill can access sensitive account-scoped tokens and act on their behalf.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
This sends an authenticated request containing account-specific data to a remote service without any user-facing notice or confirmation. In this skill context, that increases risk because the script is part of an automation/trading capability where silent retrieval of private portfolio data could occur unexpectedly and normalize unattended secret-backed network access.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The script silently uses stored credentials to fetch remote market data, which may also reveal user-associated context through authenticated API usage patterns and broader account access. In an agent skill for trading, silent authenticated network calls are more dangerous because they can be chained with other capabilities and may exceed user expectations for a simple 'positions' display script.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script places a real, irreversible wager immediately after printing a status banner, with no interactive confirmation, dry-run mode, or force flag gating execution. In a trading skill, accidental invocation, parameter mix-ups, or automation errors can directly cause financial loss because the action sends a live authenticated POST to the betting API.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This script performs an irreversible market-resolution action immediately after minimal argument validation, with no confirmation prompt, dry-run mode, secondary approval, or verification that the operator intended to resolve the specific market. In a trading/resolution skill, accidental or induced execution can directly change market outcomes and affect funds, making the lack of safety interlocks materially dangerous in context.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "  Resolution: $RESOLUTION"
echo "───────────────────────────────────────"

RESPONSE=$(curl -s -X POST \
  -H "Authorization: Bearer $MM_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"outcome\": \"$RESOLUTION\"}" \
Confidence
89% confidence
Finding
curl -s -X POST \ -H "Authorization: Bearer $MM_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.