ClawHub
Back to skill

Security audit

Test Trading

Security checks for vulnerabilities and agentic risk

Overview

This is a real trading skill with dry-run code, but its documentation and manifest grant broad automated financial authority that needs careful review before installation.

Review before installing. Use this only in an isolated environment with minimal funds, pinned dependencies, and explicit operator approval for every live trade and token approval. Do not print or store reusable exchange credentials unless you trust the external service and understand its retention, revocation, and custody model. Disable or avoid the managed cron schedule unless recurring execution is intentional.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:101
Finding

Disclosure and External Registration of Reusable Exchange Credentials

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:190
Finding

Automatic On-Chain Token Approval Without Explicit User Authorization

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
clawhub.json:32
Finding

Managed Recurring Execution Enabled by Default

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
clawhub.json:5
Finding

Unpinned and Inconsistent Trading SDK Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation directs the agent to automatically verify balances, allowances, and to send approval transactions automatically when needed. Automatic approvals and live trading actions can authorize asset movement or enable future exchange spending without a distinct user acknowledgment, which is especially risky in a financial skill handling wallet credentials.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file claims dry-run-by-default behavior requiring explicit live execution, but the later default execution policy says to prefer market mode and place orders without blocking on extra confirmation. That contradiction can cause an agent or operator to assume simulation-only behavior while the documented policy enables live order placement, creating a direct financial-loss risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented default policy allows orders to be placed without extra confirmation and emphasizes reporting final parameters after the fact. In a trading context, that removes a critical human checkpoint before irreversible market actions and materially raises the risk of unintended or manipulated live trades.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · divergence_trader.py (reported line 22)May include surrounding context.

python
SKILL_SLUG = "aionmarket-trading"
TRADE_SOURCE = f"sdk:{SKILL_SLUG}"
ENV_PATH = Path(__file__).with_name(".env")


def load_env() -> None:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documents use of environment-provided secrets such as API keys and wallet private keys, but the manifest declares no explicit tool scope or permissions boundary. That mismatch increases the chance an agent can access sensitive environment variables without operators realizing the skill needs secret material, which weakens review and containment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as a narrow divergence trader, but it also includes wallet bootstrap and account-management workflows beyond simple trade execution. This scope expansion makes the skill more dangerous because users may approve a trading template while overlooking that it can modify account configuration and credential state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill accepts a specific market and probability input, yet it also documents broad market search, event traversal, and opportunity discovery features. In context, that expands the agent from an execution wrapper into a scanner that can originate trades on markets the user did not explicitly specify, increasing autonomy and risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Agent registration, credential bootstrap, and related account lifecycle operations exceed the stated purpose of executing a trade on a provided market and probability estimate. Bundling these powers into a strategy skill unnecessarily broadens the blast radius if the skill is invoked in an automated environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The checklist explicitly endorses automatic balance/gas/allowance handling and auto-approval when possible, which is autonomous transaction decision-making. In the context of a wallet-connected trading skill, that autonomy is more dangerous because approval transactions can expand spend authority and may be triggered without granular review.

Content

Scanner excerpt · SKILL.md (reported line 475)May include surrounding context.

md
- [ ] `get_me()` returns valid agent info
- [ ] Polymarket CLOB credentials derived from private key and registered via `register_wallet_credentials()`
- [ ] automatic balance, gas/fees, and allowance checks are part of the trading flow
- [ ] missing allowance is auto-approved when technically possible
- [ ] Risk limits configured via `update_settings()`
- [ ] Heartbeat loop (`get_briefing()`) running or planned
- [ ] Error handling wraps every SDK call with `ApiError`

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:118