Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for market analytics and trading, but it can place or cancel real orders without a local confirmation step or strong client-side safeguards.

Review this carefully before installing. Use a small, revocable, least-privilege prob.trade key if available, avoid storing live trading secrets in a shared or backed-up directory, and do not let an agent run order or cancel commands without your explicit review of market, side, amount, price, and order ID.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: lib/api_client.py:31
Finding: Trading Credentials Are Unnecessarily Sent to Public Analytics Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/probtrade.py:127
Finding: Financial Orders Lack Local Bounds and Semantic Validation
Content: View full analysis
Remediation: View remediation
0` and define a documented maximum order amount. 4. Enforce the documented limit-price range of `0.01` through `0.99`. 5. Reject `--price` for market orders to prevent ambiguous input. 6. Prefer decimal arithmetic over binary floating-point for monetary amounts and prices. 7. Add an explicit confirmation or dry-run step for financial actions, especially orders over a configurable threshold. 8. Retain equivalent server-side validation because client-side controls can be bypassed. 9. Return structured validation errors without transmitting an invalid signed request. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README encourages broad natural-language use such as buying, cancelling, and querying positions without describing confirmation gates or requiring explicit command syntax for sensitive actions. In an agent setting, this can lead to unintended activation or misinterpretation of user intent, especially for trading actions tied to real funds.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: The setup instructions tell users to store long-lived API credentials in a local config file under the skill directory, which creates a persistent secret on disk. If filesystem permissions, backups, logs, or other local components are compromised, the key could be recovered and used to place trades or access account data.
Content: Scanner excerpt · README.md (reported line 59)May include surrounding context.
md
### Setup 1. Go to [app.prob.trade](https://app.prob.trade) and create an account 2. Navigate to Settings and generate an API key 3. Configure the skill:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trading section describes real-money buy, sell, and cancel operations but does not clearly warn that these actions can affect live funds and may be irreversible once executed. In an autonomous or semi-autonomous agent environment, omission of such warnings increases the chance that users trigger financially impactful actions without appreciating the risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 100)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
## API - **Public Analytics API** (no auth): [api.prob.trade/api/public](https://api.prob.trade/api/public/overview) — markets, stats, traders - **Trading API** (API key + HMAC): [api.prob.trade/api/trading](https://api.prob.trade/api/trading) — orders, positions, balance ## Links

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares required environment variables, local config file access, and network use, but does not explicitly scope or constrain those capabilities with permissions or allowed-tools metadata. In an agent context, this weakens least-privilege controls and makes it easier for the skill to access secrets and perform external requests without clear policy boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents live trading and order-cancellation commands but does not clearly warn that these actions can execute real financial transactions. In an AI-agent workflow, users or downstream agents may invoke these commands as if they were read-only analytics, causing unintended trades, losses, or cancellation of active orders.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes live trading operations (order and cancel) that execute immediately once invoked, with no confirmation prompt, dry-run mode, or secondary approval step. In a tool designed for financial trading, this increases the risk of accidental or manipulated order placement/cancellation through user error, prompt injection in higher-level agents, or misuse of delegated automation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.