prediction-markets-research

• Outcome: Review
• Latest audit: Aug 10, 2026 · 6:47 PM UTC
• Version: 1.0.1

Overview

The skill is mostly a prediction-market data reader, but its helper script is broader than disclosed and can send arbitrary requests and payloads to Crawlora-backed endpoints.

Install only if you are comfortable giving the skill a Crawlora API key and letting the agent make outbound Crawlora requests. Prefer a version that restricts the helper to the documented Polymarket, Kalshi, and Metaculus endpoints and avoids sending arbitrary POST bodies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs use of shell commands and an external helper script, but it does not declare permissions or capability boundaries for shell execution. In an agent environment, undeclared shell capability weakens governance and can let a seemingly narrow research skill invoke broader local execution paths than reviewers or policy controls expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a prediction-markets research tool, but the described helper usage implies it can function as a generic Crawlora API client with arbitrary endpoint access and POST payloads. That mismatch is dangerous because users, reviewers, and routing logic may trust it with low-risk market-data tasks while it can actually exfiltrate data to unrelated third-party endpoints or perform broader external actions through the API.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The helper accepts an arbitrary API path and example usage explicitly shows unrelated endpoints such as Amazon, YouTube, and Google, while the skill is described as prediction-market research only. In an agent setting, this creates a scope-expansion primitive that can be abused to fetch unrelated third-party data through the skill, bypassing the principle of least privilege and the declared skill boundary.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script concatenates a caller-controlled path onto the API base and forwards arbitrary GET parameters or POST bodies, giving the invoking agent broad access to any Crawlora-supported data source. In the context of a skill meant for prediction markets, this unjustified capability can be repurposed for data exfiltration, policy bypass, or retrieval of unrelated sensitive content from third-party services exposed by Crawlora.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The file explicitly instructs use of an API key header for outbound requests but does not include any warning to avoid sending secrets derived from user input or to obtain consent before external transmission. In a skill that brokers requests to third-party infrastructure, missing credential-handling guidance increases the risk of accidental secret exposure or unreviewed authenticated requests.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi

• Confidence: 90% confidence
• Finding: curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:23