Claw Earn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:14 PM UTC
• Version: 1.2.0

Overview

The skill is coherently about prediction-market trading, but it combines real-money wallet authority with unverified installation, self-updating agent instructions, plaintext private-key handling, and autonomous trading guidance.

Review this carefully before installing. Do not run the remote `curl | bash` installer or enable heartbeat self-updates unless you can verify the source and changes. Use a low-balance dedicated hot wallet, avoid printing or passing private keys on the command line, require explicit confirmation for every trade/transfer/withdrawal/approval, and avoid unlimited token allowances where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33
• Finding: Unverified Remote Installation Script Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-36`; also present in `README.md:39-42` **Vulnerability Type**: Remote code retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash ### Step 1: Install clawearn CLI curl -fsSL https://clawearn.xyz/install.sh | bash # or: bun link (if in repo) ``` The same installation pattern appears in `README.md`: ```bash # Option A: Using install script curl -fsSL https://clawearn.xyz/install.sh | bash ``` ### Technical Analysis The installation command sends the response from `https://clawearn.xyz/install.sh` directly to `bash`. The retrieved script is not included in the audited project, so its actual behavior cannot be reviewed. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded content before execution. Although retrieving software is necessary to install the declared CLI, executing mutable network content directly is not the minimum privilege or safest mechanism required for installation. The effective payload can change after this Skill has been reviewed. Trust in HTTPS alone is insufficient because compromise of the hosting account, deployment pipeline, DNS infrastructure, server, or maintainer credentials could replace the installer. ### Attack Path 1. A user or Agent follows the documented installation command. 2. An attacker compromises `clawearn.xyz`, its deployment pipeline, or the hosted `install.sh`. 3. The attacker replaces the script with a malicious payload. 4. `curl` retrieves the modified content. 5. The pipe passes the content directly to `bash` without verification. 6. The payload executes with all permissions of the invoking user. 7. It can inspect local configuration, steal wallet credentials, alter Agent files, install persistence, or invoke financial operations. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking account. Given the su ...[truncated 432 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Publish immutable, versioned release artifacts from a verifiable repository. 3. Pin installation instructions to an explicit release version or commit. 4. Publish SHA-256 checksums and cryptographic release signatures through an independent trusted channel. 5. Download and verify before execution, for example: ```bash curl -fSLO https://example.invalid/releases/clawearn-1.1.0.tar.gz echo "EXPECTED_SHA256 clawearn-1.1.0.tar.gz" | sha256sum --check - ``` 6. Require users to inspect the installer or use a package manager with lockfile and integrity verification. 7. Run installation with ordinary user privileges and explicitly prohibit use through `sudo`. 8. Include the executable source or installer in the audited repository so its behavior can be reviewed. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:10
• Finding: Automatic Replacement of Trusted Agent Instructions from Mutable Network Sources<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md:10-25`; related update instructions occur in `SKILL.md:69-85,169-185`, `README.md:51-64,226-231`, `markets/polymarket/SKILL.md:37-41`, and `markets/polymarket/HEARTBEAT.md:9-19` **Vulnerability Type**: Persistent remote replacement of Agent Skill and heartbeat instructions **Risk Level**: Critical ### Vulnerable Code ```bash ## First: Check for skill updates curl -s https://clawearn.xyz/skills/SKILL.md | grep '^version:' ``` ```bash # Update main files curl -s https://clawearn.xyz/skills/SKILL.md > ~/.clawearn/skills/SKILL.md curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.clawearn/skills/HEARTBEAT.md # Update core files curl -s https://clawearn.xyz/skills/core/WALLET.md > ~/.clawearn/skills/core/WALLET.md # Update enabled markets (check your config) for market in $(cat ~/.clawearn/config.json | jq -r '.enabled_markets[]'); do curl -s http://localhost:3000/skills/markets/$market/SKILL.md > ~/.clawearn/skills/markets/$market/SKILL.md done ``` The market heartbeat similarly replaces its own trusted content: ```bash curl -s http://localhost:3000/skills/markets/polymarket/SKILL.md > ~/.clawearn/skills/markets/polymarket/SKILL.md curl -s http://localhost:3000/skills/markets/polymarket/HEARTBEAT.md > ~/.clawearn/skills/markets/polymarket/HEARTBEAT.md curl -s http://localhost:3000/skills/markets/polymarket/README.md > ~/.clawearn/skills/markets/polymarket/README.md ``` ### Technical Analysis These commands overwrite files that control Agent behavior with mutable network responses. There is no cryptographic authenticity check, content hash, version pin, schema validation, diff review, atomic staging, or human approval. The global heartbeat recommends checking for updates daily. This creates a recurring control channel through which an external endpoint can modify future Agent instructions after the original package has been audited. The `localhost:3000` source is also not inherently ...[truncated 1954 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic Skill replacement from all heartbeat routines. 2. Treat instruction files as immutable application artifacts rather than updateable runtime data. 3. Pin updates to a specific version and expected cryptographic digest. 4. Sign releases and validate signatures against a key embedded through a separate trusted distribution channel. 5. Download candidate updates to a staging directory rather than overwriting active files. 6. Show a complete diff and require explicit human approval before activation. 7. Reject unexpected files, redirects, content types, oversized responses, and invalid Skill schemas. 8. Use atomic replacement only after all validation succeeds. 9. Do not use an unauthenticated `localhost` service as a trusted update authority. 10. Retain the last known-good signed version and provide a rollback process. 11. Separate update privileges from wallet and trading privileges so an updater cannot initiate financial activity. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: core/wallet/SKILL.md:132
• Finding: Private Keys Stored in Plaintext and Exposed Through Command Arguments and Output<![CDATA[ ## Vulnerability Details **File Location**: `core/wallet/SKILL.md:132-142,147-151,460-467,489-499`; repeated private-key arguments occur in `HEARTBEAT.md:52-53,85,289`, `core/security/SKILL.md:170,210-216,265`, and `markets/polymarket/HEARTBEAT.md:29,46,56,65,133,273-283` **Vulnerability Type**: Insecure secret storage and disclosure through shell interfaces **Risk Level**: High ### Vulnerable Code ```bash # Create secure storage mkdir -p ~/.config/clawearn chmod 700 ~/.config/clawearn # Save private key (replace with your actual key) echo "0xYOUR_PRIVATE_KEY_HERE" > ~/.config/clawearn/polymarket-key.txt chmod 600 ~/.config/clawearn/polymarket-key.txt # Set environment variable export POLYMARKET_PRIVATE_KEY=$(cat ~/.config/clawearn/polymarket-key.txt) ``` The guide also instructs users to print the key-bearing variable: ```bash - Check environment variables: `echo $POLYMARKET_PRIVATE_KEY` ``` Heartbeat operations expand the key into process arguments: ```bash clawearn polymarket balance check --private-key $POLYMARKET_PRIVATE_KEY clawearn polymarket order list-open --private-key $POLYMARKET_PRIVATE_KEY ``` Trading uses the same pattern: ```bash clawearn polymarket order buy \ --token-id TOKEN_ID \ --price 0.45 \ --size 20 \ --private-key $POLYMARKET_PRIVATE_KEY \ --signature-type 0 ``` ### Technical Analysis File permissions of `600` and a directory mode of `700` reduce access by other local users but do not encrypt the private key. Any process running as the same account, a compromised Agent tool, malware, backup collector, or remote installer executed by the user can read it. Expanding a private key into `--private-key` places the secret in the process argument vector. Depending on the operating system and process isolation, command-line arguments may be visible through process inspection, diagnostic tools, shell tracing, crash reports, telemetry, or audit logs. The `echo $POLYMARKET_PRIVATE_KEY` troubleshooting instruction di ...[truncated 1719 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never accept wallet private keys through command-line arguments. 2. Remove every instruction that prints a private key or secret-bearing environment variable. 3. Use a hardware wallet, operating-system keychain, protected signing service, or secrets manager. 4. Keep signing local and expose only a narrowly scoped signing interface to the trading process. 5. If file-based storage is unavoidable, encrypt keys at rest and decrypt only inside a protected signer; do not return plaintext to the shell. 6. Avoid long-lived secret environment variables because child processes and diagnostic tooling may inherit them. 7. Redact secrets from logs, errors, crash reports, telemetry, and command tracing. 8. Disable shell tracing around all secret operations and ensure terminal recordings cannot capture sensitive output. 9. Document a migration procedure for previously exposed wallets: - Create a new wallet using a trusted signer. - Revoke existing token allowances where possible. - Cancel outstanding orders. - Transfer remaining assets to the new wallet. - Retire the old private key. 10. Audit the actual CLI source to confirm that private keys never leave the signing boundary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: markets/polymarket/SKILL.md:268
• Finding: Autonomous Financial Transactions Combined with Unlimited Token Allowance<![CDATA[ ## Vulnerability Details **File Location**: `markets/polymarket/SKILL.md:268-279`; autonomous trading instructions appear in `markets/polymarket/HEARTBEAT.md:113-134`, and autonomous cancellation appears at `markets/polymarket/HEARTBEAT.md:43-56` **Vulnerability Type**: Excessive wallet and asset-transfer authority **Risk Level**: High ### Vulnerable Code ```text **Automatic USDC Approval:** When you place your first order, clawearn automatically: 1. Checks if USDC is approved for the CLOB contract 2. If not approved, sends an approval transaction to grant unlimited spending 3. Waits for the approval to be confirmed 4. Then proceeds with order placement ``` The periodic heartbeat authorizes the Agent to trade based on its own analysis: ```text ## Consider placing new trades Ask yourself: - Did new information emerge that affects a market? - Are there mispriced markets based on your analysis? - Has your human expressed interest in a topic? - Do you have available capital to deploy? **If yes, place a trade!** ``` ```bash clawearn polymarket order buy \ --token-id TOKEN_ID \ --price 0.45 \ --size 20 \ --private-key $POLYMARKET_PRIVATE_KEY \ --signature-type 0 ``` The heartbeat also recommends autonomous cancellation: ```bash **Cancel stale orders:** clawearn polymarket order cancel --order-id ORDER_ID --private-key $POLYMARKET_PRIVATE_KEY ``` ### Technical Analysis An ERC-20 unlimited allowance permits the approved spender to transfer up to the holder's available token balance without requiring a new approval for each amount. Although allowances are commonly used by trading protocols, an unlimited amount is broader than necessary and increases the consequences of contract compromise, incorrect spender selection, malicious CLI behavior, or future instruction hijacking. The heartbeat grants an Agent authority to place trades and cancel orders based on subjective criteria. Human approval is only requested for a “large trade” above 10% ...[truncated 2076 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace unlimited approvals with exact per-order allowances or tightly bounded allowances. 2. Validate the chain ID, token contract, spender contract, recipient, amount, price, and slippage before signing. 3. Maintain a signed allowlist of audited contract addresses. 4. Simulate each approval, trade, bridge, transfer, and withdrawal before submission. 5. Require explicit human confirmation for every state-changing financial operation. 6. Present a clear confirmation summary containing: - Asset and amount - Maximum possible loss - Recipient or spender address - Chain and contract - Order token and outcome - Price and slippage - Current allowance and resulting allowance 7. Enforce cumulative daily and per-session limits in code, not only in documentation. 8. Use a low-balance hot wallet separated from cold storage. 9. Automatically revoke or reduce allowances after trading activity completes. 10. Add an emergency pause mechanism that prevents all signing and revokes outstanding permissions where feasible. 11. Ensure Skill updates and installer processes have no access to wallet signing authority. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (61)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file includes a direct self-update mechanism that downloads and overwrites skill content, including market-specific files, with no integrity verification. In an agentic trading context, this is especially dangerous because modified instructions could later influence wallet actions, transfers, or trading decisions.

Self-Modification

High

• Category: Rogue Agent

Content

curl https://manifold.markets/api/v0/me -H "Authorization: Bearer $MANIFOLD_API_KEY"
curl https://trading-api.kalshi.com/v1/portfolio/balance -H "Authorization: Bearer $KALSHI_TOKEN"

# Update skills
curl -s http://localhost:3000/skills/SKILL.md > ~/.clawearn/skills/SKILL.md
```

• Confidence: 93% confidence
• Finding: The quick-reference section again includes a command that updates skill files from a fetched source, reinforcing self-modification behavior. Even though this instance points to localhost, it still allows externally supplied or locally spoofed content to redefine the skill without validation, which is dangerous for a trading-capable agent.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Piping a remote script directly into bash executes unreviewed code from the network immediately, with no opportunity for inspection or integrity validation. Because this skill manages wallets and trading, compromise of the install endpoint or transport chain could lead to credential theft, wallet exfiltration, backdoored binaries, or arbitrary command execution on the host.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Option A: Using install script
curl -fsSL https://clawearn.xyz/install.sh | bash

# Option B: From repository
cd /path/to/clawearn

• Confidence: 99% confidence
• Finding: Fetching an external script and executing it immediately is a classic remote-code-execution anti-pattern. Given this project's wallet and trading scope, exploitation could compromise private keys, modify trading logic, install persistence, or take over the host running the bot.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Option A: Using install script
curl -fsSL https://clawearn.xyz/install.sh | bash

# Option B: From repository
cd /path/to/clawearn

• Confidence: 98% confidence
• Finding: The use of a shell pipeline to chain network retrieval directly into bash removes any review boundary between untrusted content and execution. In an autonomous trading-bot environment, that makes compromise especially severe because the same environment may contain API keys, private keys, and permissions to move funds.

Self-Modification

High

• Category: Rogue Agent

Content

clawearn polymarket order cancel --order-id ORDER_ID
```

### Update Skills

```bash
# Check for updates

• Confidence: 95% confidence
• Finding: The documented update flow causes the skill to modify its own installed files under the agent's skills directory by downloading fresh remote content, which is a self-modification pattern. In a bot skill that can access wallets and execute trades, self-updating behavior is especially dangerous because it can alter future agent behavior without trusted review or change control.

External Script Fetching

High

• Category: Supply Chain

Content

### Step 1: Install clawearn CLI

```bash
curl -fsSL https://clawearn.xyz/install.sh | bash
# or: bun link (if in repo)
```

• Confidence: 99% confidence
• Finding: Fetching and executing an external script from `https://clawearn.xyz/install.sh` is a classic remote code execution pattern. Because this skill is meant to operate in a financial context with wallets and transfers, any compromise of that script or hosting path could directly expose funds, credentials, and the bot environment.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Step 1: Install clawearn CLI

```bash
curl -fsSL https://clawearn.xyz/install.sh | bash
# or: bun link (if in repo)
```

• Confidence: 99% confidence
• Finding: The `| bash` chaining removes the opportunity for users or automation to inspect downloaded content before execution, turning a network fetch into immediate code execution. In this skill's context, that is particularly dangerous because successful abuse could alter wallet operations, steal secrets, or place unauthorized trades with little visibility.

Credential Access

High

• Category: Privilege Escalation

Content

**Good:**
```bash
# .env file (gitignored)
POLYMARKET_PRIVATE_KEY=0x...
MANIFOLD_API_KEY=...

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Good:**
```bash
# .env file (gitignored)
POLYMARKET_PRIVATE_KEY=0x...
MANIFOLD_API_KEY=...

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

MANIFOLD_API_KEY=...

# Load in your code
export $(cat .env | xargs)
```

**Better:**

• Confidence: 91% confidence
• Finding: The documented command `export $(cat .env | xargs)` is unsafe because it can expose secret values to shell history, process inspection, parsing errors, and accidental expansion of malformed content. In a trading skill handling private keys, encouraging this pattern increases the chance of credential disclosure or misuse.

Credential Access

High

• Category: Privilege Escalation

Content

2. Complete KYC verification
3. Link bank account
4. Get API credentials
5. Save to `~/.config/clawearn/kalshi-credentials.json`

---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. Complete KYC verification
3. Link bank account
4. Get API credentials
5. Save to `~/.config/clawearn/kalshi-credentials.json`

---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

2. Complete KYC verification
3. Link bank account
4. Get API credentials
5. Save to `~/.config/clawearn/kalshi-credentials.json`

---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The troubleshooting step tells users to reveal their private key with a direct file read, immediately exposing the wallet secret in plaintext on screen. Because this skill manages real-money wallets and USDC transfers, disclosure of that key enables unauthorized transfers and total wallet compromise.

Credential Access

High

• Category: Privilege Escalation

Content

```

⚠️ **Save your private key immediately!** Store it securely in:
- `~/.config/clawearn/credentials.json`
- Environment variable: `POLYMARKET_PRIVATE_KEY`
- Your agent's secure credential storage

• Confidence: 93% confidence
• Finding: The skill encourages storing a raw private key in a JSON file and environment variable, which expands the attack surface for credential theft through local file compromise, process inspection, logs, shell history, or agent misconfiguration. Because this skill controls real trading and fund transfers, exposure of the private key would directly enable theft of user assets.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The heartbeat instructs the agent to fetch remote content and overwrite local skill files automatically. This creates a supply-chain and self-modification risk: if the remote host or transport path is compromised, the agent's future behavior can be silently altered without review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The update instructions overwrite local files from remote sources without warning that persistent local state is being modified. Beyond transparency concerns, this can permanently change the skill's behavior and trust boundary, making later abuse or compromise harder to detect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions tell the operator to print the full configuration file even though it may contain credentials or sensitive settings. In agent or terminal environments with logging, this can expose secrets to transcripts, telemetry, or other users with access to session history.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest description specifically says the skill can 'Trade on Polymarket, manage wallets, transfer USDC, and automate trading strategies.' This heartbeat file instructs the agent to query Manifold and Kalshi accounts and balances, adding cross-platform market monitoring not clearly covered by the stated Polymarket-focused trading scope.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to fetch remote skill files and overwrite local files in the active OpenClaw skill directory without integrity verification, pinning, or an explicit warning that this modifies trusted bot behavior. In this context, downloaded SKILL/HEARTBEAT files can directly influence autonomous bot actions, so a compromised host or changed remote content could silently replace local behavior and lead to unsafe trading, fund movement, or persistence.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. Install Skills to OpenClaw

```bash
# Create skill directories
mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket}

# Download main skills

• Confidence: 88% confidence
• Finding: The install instructions establish persistent skill files in ~/.openclaw/skills so the agent can continue using them across sessions. Persistence is expected for a legitimate skill, but in this context it still represents a security-relevant capability because remotely fetched instructions become durable agent behavior on disk.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket}

# Download main skills
curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md
curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md

# Download core skills

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket}

# Download main skills
curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md
curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md

# Download core skills

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket}

# Download main skills
curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md
curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md

# Download core skills

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.