Security audit

Weather High-Temp Sniper

Security checks for vulnerabilities and agentic risk

Overview

This is a real-money Polymarket trading skill whose managed execution and default redemption behavior can affect an account more broadly than the documentation clearly explains.

Review this carefully before installing. Use only isolated, low-balance trading credentials, keep WALLET_PRIVATE_KEY unset unless you fully trust the runtime, disable SIMMER_SNIPER2_ENABLE_REDEEM unless you want account-wide automatic redemption, and do not rely on managed execution being dry-run by default.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sniper.py:1087
Finding: Managed Execution Defaults to Live Financial Operations
Content: View full analysis
Vulnerability Details

File Location: scripts/sniper.py:1087-1096; related live-mode selection at scripts/sniper.py:1208-1209 and managed entrypoint declaration at clawhub.json:8-12
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

python
def agent_tool_main(): input_data = {} try: input_data = json.load(sys.stdin) except Exception: pass dry_run = input_data.get("dry_run", False) try: stats = run_once(dry_run=dry_run) result = {"status": "success", "message": "Sniper cycle completed", "live": not dry_run, "timestamp": datetime.utcnow().isoformat() + "Z", "stats": stats}

The command-line execution path also treats a managed environment as authorization for live trading:

python
live = args.live or bool(os.environ.get("AUTOMATON_MANAGED")) dry_run = not live

The package declares managed execution:

json
"automaton": { "managed": true, "entrypoint": "scripts/sniper.py" }

Technical Analysis

The documented behavior states that dry-run is the default and that live trading requires the explicit --live argument. The managed and non-interactive execution paths violate that safety boundary.

agent_tool_main() treats a missing dry_run field as False. Consequently, empty input, malformed JSON, or an invocation that omits this optional field results in run_once(dry_run=False). The command-line path independently promotes execution to live mode whenever AUTOMATON_MANAGED contains any non-empty value.

Once live mode is selected, the program creates a live Simmer client and can execute order and redemption operations. An environment marker or omitted JSON property is not sufficient evidence of informed authorization for financial transactions.

Attack Path

A user installs or enables the Skill under the managed OpenClaw configuration.

T ...[truncated 1092 chars]
Remediation: View remediation
Remediation Suggestions

Change every execution path to default to dry-run:

python
dry_run = input_data.get("dry_run", True)

Require an explicit boolean live authorization rather than inferring it from a missing field or environment marker.

Do not treat AUTOMATON_MANAGED as authorization to trade. It should identify the runtime only.

Require two independent controls for live operation, such as an invocation-level live: true value and a persistent SIMMER_SNIPER2_LIVE_ENABLED=true setting.

Reject malformed or absent input instead of silently continuing with transaction-capable defaults.

Return a clear preview of proposed orders and require user confirmation before the first live operation.

Add regression tests proving that empty input, malformed JSON, omitted options, and managed mode cannot initiate live transactions.

Update the documentation to describe all execution modes and their exact authorization requirements.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/sniper.py:605
Finding: Default Redemption Cycle Operates on Unrelated Polymarket Positions
Content: View full analysis
Vulnerability Details

File Location: scripts/sniper.py:605-624; enabled by default at scripts/sniper.py:79-80 and invoked at scripts/sniper.py:891-906
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code

python
def run_redeem_cycle(client, dry_run: bool = False) -> dict: """Run one redeem cycle. Returns stats dict.""" stats = {"checked": 0, "redeemed": 0, "failed": 0, "errors": []} try: positions = client.get_positions(venue="polymarket") redeemable = [p for p in positions if getattr(p, 'redeemable', False)] stats["checked"] = len(redeemable) log.info(f"[REDEEM] Found {len(redeemable)} redeemable positions") for pos in redeemable: market_id = getattr(pos, 'market_id', None) or (pos.get('market_id') if isinstance(pos, dict) else None) side = getattr(pos, 'side', None) or (pos.get('side') if isinstance(pos, dict) else None) if not market_id or not side: continue q = getattr(pos, 'question', '') or (pos.get('question', 'N/A')) log.info(f"[REDEEM] Redeeming: {q[:50]}... ({market_id}, side={side})") try: if dry_run: log.info(f"[REDEEM] Dry-run: would redeem {market_id}") continue result = client.redeem(market_id=market_id, side=side)

Redemption is enabled by default:

python
"enable_redeem": {"env": "SIMMER_SNIPER2_ENABLE_REDEEM", "type": bool, "default": True}, "redeem_interval_seconds": {"env": "SIMMER_SNIPER2_REDEEM_INTERVAL", "type": int, "default": 3600},

Technical Analysis

The Skill is declared as an automated trader for highest-temperature weather markets. However, the redemption function retrieves all positions for the Polymarket venue and redeems every position whose API object reports ` ...[truncated 1799 chars]
Remediation: View remediation
Remediation Suggestions

Set enable_redeem to False by default.

Maintain a durable allowlist of market IDs and position identifiers created by this Skill.

Redeem only when the position is both redeemable and present in that allowlist.

Verify that the market satisfies the same highest-temperature weather-market filter before submitting a transaction.

Require explicit user authorization before enabling automated redemption.

Provide a preview listing each market, side, amount, and expected effect before the first redemption cycle.

Introduce separate API credentials or account scopes for discovery, trading, and account-wide settlement if supported by Simmer.

Document redemption prominently in SKILL.md, including its default, scope, frequency, and financial effects.

Add tests demonstrating that unrelated positions are never passed to client.redeem().

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Credential-Capable Dependencies Are Installed Without Reproducible Version Pinning
Content: View full analysis
Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

text
simmer-sdk>=0.1.0 requests>=2.28.0 python-dotenv>=0.21.0 pytz>=2022.7

Technical Analysis

Every dependency uses an open-ended minimum-version constraint. No exact versions, upper bounds, lockfile, or package hashes are provided. A future installation can therefore resolve to package versions that were not present during this audit.

This is particularly sensitive for simmer-sdk. The application passes SIMMER_API_KEY and, optionally, WALLET_PRIVATE_KEY to SimmerClient. A compromised, malicious, or unexpectedly changed SDK release would execute in the same Python process and could access these credentials and transaction functionality.

The repository does not establish that any current dependency is malicious. The vulnerability is the lack of reproducible and integrity-verified dependency resolution for packages operating in a credential-bearing financial context.

Attack Path

An attacker compromises a dependency maintainer account, package release process, or distribution artifact.

A new malicious version is published with a version satisfying the open-ended >= requirement.

A user follows the documented command pip install -r requirements.txt.

The resolver installs the newer unreviewed release.

The package executes during installation or import.

It can read process environment variables, including API or wallet credentials, and can tamper with market data or transaction calls.

Impact Assessment

A compromised dependency would run with the same local permissions as the Skill. It could access files readable by that user, inspect environment variables, alter trading decisions, submit unauthorized API requests, or exfiltrate SIMMER_API_KEY, Telegram credentials, and potentially WALLET_PRIVATE_KEY.

...[truncated 286 chars]
Remediation: View remediation
Remediation Suggestions

Pin every direct dependency to an exact reviewed version.

Generate a lockfile that includes all transitive dependencies.

Record and enforce cryptographic hashes with pip --require-hashes.

Install only from an explicitly configured trusted package index.

Review changelogs and security advisories before updating pinned versions.

Run dependency vulnerability and provenance scanning in continuous integration.

Isolate the trading process in a restricted environment with minimal filesystem and network access.

Avoid exposing WALLET_PRIVATE_KEY to the SDK process where a scoped signing mechanism or external signer is available.

Rotate credentials immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (30)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · scripts/sniper.py (reported line 99)May include surrounding context.
python
MER_SNIPER2_ENABLE_TP_SL", "TAKE_PROFIT": "SIMMER_SNIPER2_TP", "STOP_LOSS": "SIMMER_SNIPER2_SL", "REPORT_INTERVAL": "SIMMER_SNIPER2_REPORT_INTERVAL", "TELEGRAM_ENABLED": "SIMMER_SNIPER2_TELEGRAM_ENABLED", "TELEGRAM_CHAT_ID": "SIMMER_SNIPER2_TELEGRAM_CHAT_ID", } for _old, _new in _LEGACY_ENV_ALIASES.items(): if _old in os.environ and _new not in os.environ: os.environ[_new] = os.environ[_old] if SKILL_FRAMEWORK: _config = load_config(CONFIG_SCHEMA, __file__, slug="polymarket-weather-high-temp-sniper") def get_cfg(key: str): return _config[key] else: def get_cfg(key: str): env_name = CONFIG_SCHEMA[key]["env"] val = os.environ.get(env_name) if val is None: return CONFIG_SCHEMA[key]["default"] typ = CONFIG_SCHEMA[key]["type"] if typ is bool: return val.lower() in ("true", "1", "yes") elif typ is int: return int(val) elif

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior does not fully match the detected behavior: the skill appears to perform automatic redemption and uses broader timing logic than the strict trading window stated in the description. For a live-trading skill, undocumented financial actions and looser execution conditions are dangerous because users may authorize automation under false assumptions, leading to unexpected trades or asset movements.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sniper.py (reported line 21)May include surrounding context.
python
from typing import List, Dict, Any, Optional # ============================================================================ # Early .env loading # ============================================================================ ROOT = Path(__file__).parent.parent.resolve() env_path = ROOT / ".env"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sniper.py (reported line 24)May include surrounding context.
python
# Early .env loading # ============================================================================ ROOT = Path(__file__).parent.parent.resolve() env_path = ROOT / ".env" if env_path.exists(): try: from dotenv import load_dotenv

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The main loop can enter live trading mode automatically based on CLI flags or environment state and then repeatedly executes strategy cycles without a just-in-time confirmation step. In a financial automation context, absence of explicit execution confirmation increases the risk of accidental real-money trades due to misconfiguration, automation platform defaults, or operator misunderstanding.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The buy path directly calls client.trade/place_order once strategy conditions are met, with no user confirmation, approval workflow, or immediate disclosure at the point of execution. Because this skill controls live market positions, silent autonomous order submission can lead to unintended losses, especially if upstream market selection or timezone detection is wrong.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README includes a real-looking Telegram bot token in a configuration example, which can be mistaken for an actual secret and may in fact be a live credential if copied from a real bot. Even if intended as a sample, publishing token-shaped secrets in docs normalizes unsafe secret handling and can lead to credential abuse, bot takeover, message interception, or spam if the token is valid.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes capabilities that require environment access, file reads/writes, and network access, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, missing scope declarations undermines least-privilege controls and makes it harder for operators to review whether the skill should be trusted with sensitive secrets, persistent state, and outbound communications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs users how to enable live trading but does not present a clear warning that this can execute real-money transactions. In a financial automation context, the absence of a prominent risk disclosure increases the chance of accidental loss, especially when the same document also presents dry-run and live modes as routine usage paths.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The configuration comments and workflow guidance place users directly on a path from registration to claiming the agent for real trading, but they do not clearly separate safe testing from live-money activation. In a trading skill, this ambiguity is risky because a user may supply credentials and unintentionally enable real-market behavior without an explicit confirmation gate or stronger warnings about financial consequences.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup text instructs the user to register and then claim the agent to enable real trading, which normalizes live trading as the expected next step without a strong opt-in safeguard in the configuration itself. Given this skill is an automated Polymarket trader and also exposes wallet/private-key related settings, this increases the chance of accidental financial exposure if a user follows the instructions casually.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 202)May include surrounding context.
python
# City -> Timezone mapping # ============================================================================ CITY_TZ_MAP = { # 鈹€鈹€ 鍖楃編鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "new york": "America/New_York", "nyc": "America/New_York", "new york city": "America/New_York", "laguardia": "America/New_York", "la guardia": "America/New_York", "boston": "America/New_York",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 232)May include surrounding context.
python
# City -> Timezone mapping # ============================================================================ CITY_TZ_MAP = { # 鈹€鈹€ 鍖楃編鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "new york": "America/New_York", "nyc": "America/New_York", "new york city": "America/New_York", "laguardia": "America/New_York", "la guardia": "America/New_York", "boston": "America/New_York",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 265)May include surrounding context.
python
# City -> Timezone mapping # ============================================================================ CITY_TZ_MAP = { # 鈹€鈹€ 鍖楃編鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "new york": "America/New_York", "nyc": "America/New_York", "new york city": "America/New_York", "laguardia": "America/New_York", "la guardia": "America/New_York", "boston": "America/New_York",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 331)May include surrounding context.
python
# City -> Timezone mapping # ============================================================================ CITY_TZ_MAP = { # 鈹€鈹€ 鍖楃編鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "new york": "America/New_York", "nyc": "America/New_York", "new york city": "America/New_York", "laguardia": "America/New_York", "la guardia": "America/New_York", "boston": "America/New_York",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 345)May include surrounding context.
python
# City -> Timezone mapping # ============================================================================ CITY_TZ_MAP = { # 鈹€鈹€ 鍖楃編鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "new york": "America/New_York", "nyc": "America/New_York", "new york city": "America/New_York", "laguardia": "America/New_York", "la guardia": "America/New_York", "boston": "America/New_York",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 321)May include surrounding context.
python
"jerusalem": "Asia/Jerusalem", "tel aviv": "Asia/Jerusalem", "haifa": "Asia/Jerusalem", "beersheba": "Asia/Jerusalem", # 鈹€鈹€ 澶ф磱娲?鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "sydney": "Australia/Sydney", "melbourne": "Australia/Melbourne", "brisbane": "Australia/Brisbane", "adelaide": "Australia/Adelaide", "perth": "Australia/Perth", "hobart": "Australia/Hobart",

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · scripts/sniper.py (reported line 360)May include surrounding context.
python
"salvador": "America/Sao_Paulo", "fortaleza": "America/Sao_Paulo", "manaus": "America/Manaus", # 鈹€鈹€ 澧ㄨタ鍝?涓編娲?鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€ "mexico city": "America/Mexico_City", "guadalajara": "America/Mexico_City", "monterrey": "America/Mexico_City", "tijuana": "America/Tijuana", "juarez": "America/Denver", "leon": "America/Mexico_City",

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code performs automatic market import and redemption in addition to trading, which expands the operational scope beyond the stated behavior. In an automated trading skill, undisclosed side effects are security-relevant because they can cause unanticipated account actions, fees, or asset movements without the operator realizing the tool does more than market discovery and order placement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The safeguard function allows trading from 9 AM to 4 PM local time, which is materially broader than the described 9–10 AM-only trading window. This mismatch undermines user expectations and risk controls, increasing the chance of trades executing outside the intended strategy constraints.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 140)May include surrounding context.
md
chat_id = get_cfg("telegram_chat_id") or os.environ.get("TELEGRAM_CHAT_ID") if not chat_id: return False url = f"https://api.telegram.org/bot{token}/sendMessage" payload = {"chat_id": chat_id, "text": text, "disable_notification": silent} try: resp = requests.post(url, data=payload, timeout=10)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sniper.py (reported line 1113)May include surrounding context.
python
chat_id = get_cfg("telegram_chat_id") or os.environ.get("TELEGRAM_CHAT_ID") if not chat_id: return False url = f"https://api.telegram.org/bot{token}/sendMessage" payload = {"chat_id": chat_id, "text": text, "disable_notification": silent} try: resp = requests.post(url, data=payload, timeout=10)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/sniper.py (reported line 1130)May include surrounding context.
python
chat_id = get_cfg("telegram_chat_id") or os.environ.get("TELEGRAM_CHAT_ID") if not chat_id: return False url = f"https://api.telegram.org/bot{token}/sendMessage" payload = {"chat_id": chat_id, "text": text, "disable_notification": silent} try: resp = requests.post(url, data=payload, timeout=10)

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency specifier simmer-sdk>=0.1.0 is unpinned, so installs may resolve to different future releases with changed behavior or newly introduced vulnerabilities. In an automated trading skill, that creates supply-chain and reproducibility risk because market-discovery or trading logic could change without review.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
simmer-sdk>=0.1.0 requests>=2.28.0 python-dotenv>=0.21.0 pytz>=2022.7

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: requests>=2.28.0 is unpinned, allowing installation of any later release, which weakens reproducibility and makes it harder to know whether known advisories apply. Because this skill likely makes network calls for market data and notifications, dependency drift in a core HTTP library increases supply-chain exposure.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
simmer-sdk>=0.1.0 requests>=2.28.0 python-dotenv>=0.21.0 pytz>=2022.7

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Tp4

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing

Description-Behavior Mismatch

Description-Behavior Mismatch

External Transmission

External Transmission

External Transmission

Unpinned Dependencies

Unpinned Dependencies

Static analysis