T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:33- Finding
Unverified Remote Installation Script Executed Directly by Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Earn
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherently about prediction-market trading, but it combines real-money wallet authority with unverified installation, self-updating agent instructions, plaintext private-key handling, and autonomous trading guidance.
Review this carefully before installing. Do not run the remote `curl | bash` installer or enable heartbeat self-updates unless you can verify the source and changes. Use a low-balance dedicated hot wallet, avoid printing or passing private keys on the command line, require explicit confirmation for every trade/transfer/withdrawal/approval, and avoid unlimited token allowances where possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
HEARTBEAT.md:10- Finding
Automatic Replacement of Trusted Agent Instructions from Mutable Network Sources
- Content
View full analysis
~/.clawearn/skills/SKILL.md curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.clawearn/skills/HEARTBEAT.md # Update core files curl -s https://clawearn.xyz/skills/core/WALLET.md > ~/.clawearn/skills/core/WALLET.md # Update enabled markets (check your config) for market in $(cat ~/.clawearn/config.json | jq -r '.enabled_markets[]'); do curl -s http://localhost:3000/skills/markets/$market/SKILL.md > ~/.clawearn/skills/markets/$market/SKILL.md done ``` The market heartbeat similarly replaces its own trusted content: ```bash curl -s http://localhost:3000/skills/markets/polymarket/SKILL.md > ~/.clawearn/skills/markets/polymarket/SKILL.md curl -s http://localhost:3000/skills/markets/polymarket/HEARTBEAT.md > ~/.clawearn/skills/markets/polymarket/HEARTBEAT.md curl -s http://localhost:3000/skills/markets/polymarket/README.md > ~/.clawearn/skills/markets/polymarket/README.md ``` ### Technical Analysis These commands overwrite files that control Agent behavior with mutable network responses. There is no cryptographic authenticity check, content hash, version pin, schema validation, diff review, atomic staging, or human approval. The global heartbeat recommends checking for updates daily. This creates a recurring control channel through which an external endpoint can modify future Agent instructions after the original package has been audited. The `localhost:3000` source is also not inherently ...[truncated 1954 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
core/wallet/SKILL.md:132- Finding
Private Keys Stored in Plaintext and Exposed Through Command Arguments and Output
- Content
View full analysis
~/.config/clawearn/polymarket-key.txt chmod 600 ~/.config/clawearn/polymarket-key.txt # Set environment variable export POLYMARKET_PRIVATE_KEY=$(cat ~/.config/clawearn/polymarket-key.txt) ``` The guide also instructs users to print the key-bearing variable: ```bash - Check environment variables: `echo $POLYMARKET_PRIVATE_KEY` ``` Heartbeat operations expand the key into process arguments: ```bash clawearn polymarket balance check --private-key $POLYMARKET_PRIVATE_KEY clawearn polymarket order list-open --private-key $POLYMARKET_PRIVATE_KEY ``` Trading uses the same pattern: ```bash clawearn polymarket order buy \ --token-id TOKEN_ID \ --price 0.45 \ --size 20 \ --private-key $POLYMARKET_PRIVATE_KEY \ --signature-type 0 ``` ### Technical Analysis File permissions of `600` and a directory mode of `700` reduce access by other local users but do not encrypt the private key. Any process running as the same account, a compromised Agent tool, malware, backup collector, or remote installer executed by the user can read it. Expanding a private key into `--private-key` places the secret in the process argument vector. Depending on the operating system and process isolation, command-line arguments may be visible through process inspection, diagnostic tools, shell tracing, crash reports, telemetry, or audit logs. The `echo $POLYMARKET_PRIVATE_KEY` troubleshooting instruction di ...[truncated 1719 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
markets/polymarket/SKILL.md:268- Finding
Autonomous Financial Transactions Combined with Unlimited Token Allowance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (61)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file includes a direct self-update mechanism that downloads and overwrites skill content, including market-specific files, with no integrity verification. In an agentic trading context, this is especially dangerous because modified instructions could later influence wallet actions, transfers, or trading decisions.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The quick-reference section again includes a command that updates skill files from a fetched source, reinforcing self-modification behavior. Even though this instance points to localhost, it still allows externally supplied or locally spoofed content to redefine the skill without validation, which is dangerous for a trading-capable agent.
- Content
curl https://manifold.markets/api/v0/me -H "Authorization: Bearer $MANIFOLD_API_KEY" curl https://trading-api.kalshi.com/v1/portfolio/balance -H "Authorization: Bearer $KALSHI_TOKEN"
Update skills
curl -s http://localhost:3000/skills/SKILL.md > ~/.clawearn/skills/SKILL.md
text
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Piping a remote script directly into bash executes unreviewed code from the network immediately, with no opportunity for inspection or integrity validation. Because this skill manages wallets and trading, compromise of the install endpoint or transport chain could lead to credential theft, wallet exfiltration, backdoored binaries, or arbitrary command execution on the host.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching an external script and executing it immediately is a classic remote-code-execution anti-pattern. Given this project's wallet and trading scope, exploitation could compromise private keys, modify trading logic, install persistence, or take over the host running the bot.
- Content
bash # Option A: Using install script curl -fsSL https://clawearn.xyz/install.sh | bash # Option B: From repository cd /path/to/clawearn
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The use of a shell pipeline to chain network retrieval directly into bash removes any review boundary between untrusted content and execution. In an autonomous trading-bot environment, that makes compromise especially severe because the same environment may contain API keys, private keys, and permissions to move funds.
- Content
bash # Option A: Using install script curl -fsSL https://clawearn.xyz/install.sh | bash # Option B: From repository cd /path/to/clawearn
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The documented update flow causes the skill to modify its own installed files under the agent's skills directory by downloading fresh remote content, which is a self-modification pattern. In a bot skill that can access wallets and execute trades, self-updating behavior is especially dangerous because it can alter future agent behavior without trusted review or change control.
- Content
clawearn polymarket order cancel --order-id ORDER_ID
text ### Update Skills ```bash # Check for updates
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching and executing an external script from
https://clawearn.xyz/install.shis a classic remote code execution pattern. Because this skill is meant to operate in a financial context with wallets and transfers, any compromise of that script or hosting path could directly expose funds, credentials, and the bot environment.- Content
Step 1: Install clawearn CLI
bash curl -fsSL https://clawearn.xyz/install.sh | bash # or: bun link (if in repo)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashchaining removes the opportunity for users or automation to inspect downloaded content before execution, turning a network fetch into immediate code execution. In this skill's context, that is particularly dangerous because successful abuse could alter wallet operations, steal secrets, or place unauthorized trades with little visibility.- Content
Step 1: Install clawearn CLI
bash curl -fsSL https://clawearn.xyz/install.sh | bash # or: bun link (if in repo)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Good:
bash # .env file (gitignored) POLYMARKET_PRIVATE_KEY=0x... MANIFOLD_API_KEY=...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Good:
bash # .env file (gitignored) POLYMARKET_PRIVATE_KEY=0x... MANIFOLD_API_KEY=...
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The documented command
export $(cat .env | xargs)is unsafe because it can expose secret values to shell history, process inspection, parsing errors, and accidental expansion of malformed content. In a trading skill handling private keys, encouraging this pattern increases the chance of credential disclosure or misuse.- Content
MANIFOLD_API_KEY=...
Load in your code
export $(cat .env | xargs)
text **Better:**
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. Complete KYC verification 3. Link bank account 4. Get API credentials 5. Save to `~/.config/clawearn/kalshi-credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. Complete KYC verification 3. Link bank account 4. Get API credentials 5. Save to `~/.config/clawearn/kalshi-credentials.json` ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. Complete KYC verification 3. Link bank account 4. Get API credentials 5. Save to `~/.config/clawearn/kalshi-credentials.json` ---
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The troubleshooting step tells users to reveal their private key with a direct file read, immediately exposing the wallet secret in plaintext on screen. Because this skill manages real-money wallets and USDC transfers, disclosure of that key enables unauthorized transfers and total wallet compromise.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill encourages storing a raw private key in a JSON file and environment variable, which expands the attack surface for credential theft through local file compromise, process inspection, logs, shell history, or agent misconfiguration. Because this skill controls real trading and fund transfers, exposure of the private key would directly enable theft of user assets.
- Content
text ⚠️ **Save your private key immediately!** Store it securely in: - `~/.config/clawearn/credentials.json` - Environment variable: `POLYMARKET_PRIVATE_KEY` - Your agent's secure credential storage
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The heartbeat instructs the agent to fetch remote content and overwrite local skill files automatically. This creates a supply-chain and self-modification risk: if the remote host or transport path is compromised, the agent's future behavior can be silently altered without review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The update instructions overwrite local files from remote sources without warning that persistent local state is being modified. Beyond transparency concerns, this can permanently change the skill's behavior and trust boundary, making later abuse or compromise harder to detect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions tell the operator to print the full configuration file even though it may contain credentials or sensitive settings. In agent or terminal environments with logging, this can expose secrets to transcripts, telemetry, or other users with access to session history.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description specifically says the skill can 'Trade on Polymarket, manage wallets, transfer USDC, and automate trading strategies.' This heartbeat file instructs the agent to query Manifold and Kalshi accounts and balances, adding cross-platform market monitoring not clearly covered by the stated Polymarket-focused trading scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to fetch remote skill files and overwrite local files in the active OpenClaw skill directory without integrity verification, pinning, or an explicit warning that this modifies trusted bot behavior. In this context, downloaded SKILL/HEARTBEAT files can directly influence autonomous bot actions, so a compromised host or changed remote content could silently replace local behavior and lead to unsafe trading, fund movement, or persistence.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The install instructions establish persistent skill files in ~/.openclaw/skills so the agent can continue using them across sessions. Persistence is expected for a legitimate skill, but in this context it still represents a security-relevant capability because remotely fetched instructions become durable agent behavior on disk.
- Content
2. Install Skills to OpenClaw
bash # Create skill directories mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket} # Download main skills
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket} # Download main skills curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md # Download core skills
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket} # Download main skills curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md # Download core skills
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md mkdir -p ~/.openclaw/skills/clawearn/{core,markets/polymarket} # Download main skills curl -s https://clawearn.xyz/skills/SKILL.md > ~/.openclaw/skills/clawearn/SKILL.md curl -s https://clawearn.xyz/skills/HEARTBEAT.md > ~/.openclaw/skills/clawearn/HEARTBEAT.md # Download core skills
Static analysis
No suspicious patterns detected.