Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly for prob.trade analytics and trading, but it can place or cancel live financial orders without an explicit confirmation or dry-run safeguard.

Review this carefully before installing. Use a restricted or low-balance prob.trade key if available, prefer environment variables or protected secret storage over a plaintext config file, revoke keys when finished, and do not let an agent place or cancel trades unless you have an explicit confirmation workflow outside the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 74% confidence
Finding: The README instructs users to store long-lived trading credentials in a local config file under the skill directory, which can create persistent secret exposure if file permissions, backups, logs, or other local tooling are not tightly controlled. In a multi-skill agent environment, persistent API credentials increase the blast radius of compromise because they can authorize real trades over time.
Content: Scanner excerpt · README.md (reported line 59)May include surrounding context.
md
### Setup 1. Go to [app.prob.trade](https://app.prob.trade) and create an account 2. Navigate to Settings and generate an API key 3. Configure the skill:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README promotes direct trading actions such as buying, selling, and canceling orders through an agent, but it does not warn that these actions can cause immediate financial loss or describe any confirmation/approval step before execution. In an agent setting, natural-language commands increase the chance of accidental or misinterpreted orders, making the absence of explicit safeguards a real security and safety issue.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 100)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises capabilities that require environment access, file reads, and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens the trust boundary for an agent runner, because the skill can access secrets from config/env and make outbound requests without a clearly constrained policy surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes live order placement and cancellation commands for a real-money prediction market, but it does not present a strong warning or require explicit confirmation for financially consequential actions. In an agent context, this creates a meaningful risk of accidental or unauthorized trades, especially because the configured API keys are intended for live use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes live trading actions that immediately place and cancel orders based solely on CLI arguments, with no runtime confirmation, dry-run mode, or explicit warning at the point of execution. In an agent/automation context, this increases the chance of unintended financial transactions from prompt mistakes, parameter confusion, or unsafe chaining with other tools, making accidental loss more likely even without malicious intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.