ClawHub
Back to skill

Security audit

Agent Template

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real WZRD prediction-market agent, but it needs review because it encourages an unverified remote installer and wallet-based autonomous betting with limited safety controls.

Review the bundled files and avoid piping the remote installer directly to bash. Use a fresh low-value wallet, keep WZRD_PRIVATE_KEY out of source control and logs, pin and audit dependencies, and only run the example agent after replacing the default strategy and adding dry-run, confirmation, and spend-limit controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Description-Behavior Mismatch

Low
Confidence
94% confidence
Finding
The README instructs users to execute a network-fetched shell script as part of setup, which creates a supply-chain risk: the remote content can change at any time and will execute with the user's privileges. In this specific skill, the risk is amplified because the same README later instructs users to configure a wallet private key, so a malicious or compromised script could steal credentials or alter trading behavior.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Piping curl output directly into bash executes unreviewed remote code immediately, eliminating any opportunity for inspection or integrity verification. Because this project handles authentication tokens and a Solana private key, a compromised endpoint or script update could lead to wallet theft, account takeover, or unauthorized market actions.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The setup guide tells users to place `WZRD_PRIVATE_KEY` in a `.env` file but gives no warning about secret handling, file permissions, accidental commits, shell history, or developer tooling exposure. In an agent-trading context, this secret directly controls wallet-based authentication and potentially redeemable value, so poor handling can lead to unauthorized trades or asset loss.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill promotes betting, redemption, swaps, staking, and gasless on-chain claims, but it does not present a prominent user warning that these actions can lose funds, convert assets, or produce irreversible on-chain effects. In a trading and prediction-market context, missing risk disclosure makes unsafe autonomous execution more likely because users or agents may treat actions as routine data operations rather than financial transactions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The agent places predictions automatically in the main loop using `client.predict(...)` with a configured stake and no interactive confirmation, approval workflow, dry-run mode, or explicit guardrail. In the context of a trading/prediction-market bot, this can cause unintended loss of points or rapid depletion from misconfiguration, bad strategy code, or API/market anomalies.

Unpinned Dependencies

Low
Category
Supply Chain
Content
aiohttp>=3.9
base58>=2.1
PyNaCl>=1.5
python-dotenv>=1.0
Confidence
97% confidence
Finding
aiohttp>=3.9

Unpinned Dependencies

Low
Category
Supply Chain
Content
aiohttp>=3.9
base58>=2.1
PyNaCl>=1.5
python-dotenv>=1.0
Confidence
95% confidence
Finding
base58>=2.1

Unpinned Dependencies

Low
Category
Supply Chain
Content
aiohttp>=3.9
base58>=2.1
PyNaCl>=1.5
python-dotenv>=1.0
Confidence
96% confidence
Finding
PyNaCl>=1.5

Unpinned Dependencies

Low
Category
Supply Chain
Content
aiohttp>=3.9
base58>=2.1
PyNaCl>=1.5
python-dotenv>=1.0
Confidence
94% confidence
Finding
python-dotenv>=1.0

Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

High
Category
Supply Chain
Confidence
92% confidence
Finding
aiohttp

Known Vulnerable Dependency: PyNaCl — 1 advisory(ies): CVE-2025-69277 (libsodium has Incomplete List of Disallowed Inputs)

Low
Category
Supply Chain
Confidence
73% confidence
Finding
PyNaCl

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
77% confidence
Finding
python-dotenv

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal