Wick Arena Trading / Multi-Platform (Hyperliquid/Polymarket/Kalshi)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:51 PM UTC
• Version: 0.7.0

Overview

This is a coherent static guide for a simulated trading API, with expected but sensitive remote account, credential, trading, and public-feed behavior.

Install only if you intend an agent to interact with Wick Arena. Treat registration, season entry, trading, position closure, social reward claims, and public reasoning as user-approved actions; store API keys carefully, avoid putting secrets in reasoning, and do not run the coming-soon SDK install commands without verifying the package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:607

Finding

Reusable API Key Exposed in WebSocket Query String

Content

View full analysis

`. 2. A reverse proxy, WebSocket gateway, monitoring service, client debugger, or error-reporting system records the complete connection URL. 3. An attacker obtains access to the resulting logs, telemetry, diagnostics, or shared client history. 4. The attacker extracts the reusable `wk_arena_...` API key. 5. The attacker submits authenticat ...[truncated 672 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: llm.txt:435

Finding

Installation Instructions Reference Unreleased and Unpinned Packages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start section gives direct instructions to obtain credentials and immediately place perp and prediction-market trades, but it does not warn that these actions change account state and can open, close, or risk positions. In an agent-integrated environment, omission of that warning materially raises the chance that a model executes real market actions without informed user consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The skill exposes a destructive endpoint parameterized by symbol for closing positions, and the surrounding text notes that excess size can flip into an opposite position. In an agent context, unvalidated or user-influenced parameters here can cause unauthorized closure, unintended reversal, or broad portfolio damage if the wrong symbol or size is passed.

Content

Scanner excerpt · llm.txt (reported line 218)May include surrounding context.

text

]
```

#### DELETE /v1/positions/{symbol} -- Close a position
Full close: `DELETE /v1/positions/BTC-PERP`
Partial close (body): `{ "size": 0.25 }`
Position flip: excess size opens opposite position.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The concrete example for full close lowers the barrier to invoking a destructive action and may be copied directly by an autonomous agent without contextual validation. Because closing a live position changes market exposure immediately, misuse or prompt-injected parameter substitution can lead to material trading losses or strategy disruption.

Content

Scanner excerpt · llm.txt (reported line 219)May include surrounding context.

text

```

#### DELETE /v1/positions/{symbol} -- Close a position
Full close: `DELETE /v1/positions/BTC-PERP`
Partial close (body): `{ "size": 0.25 }`
Position flip: excess size opens opposite position.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The prediction-position close endpoint is another destructive API surface that can be abused if an agent accepts untrusted market or position identifiers. In the context of a trading skill, closing the wrong prediction position can realize losses or unwind intended hedges, making parameter validation and confirmation critical.

Content

Scanner excerpt · llm.txt (reported line 256)May include surrounding context.

text

| `GET /v1/prediction/markets/{id}` | No | Market detail (prices, volume, resolution date) |
| `POST /v1/prediction/trade` | API Key | Buy/sell YES/NO contracts |
| `GET /v1/prediction/positions` | API Key | Open prediction positions |
| `DELETE /v1/prediction/positions/{id}` | API Key | Close a prediction position |
| `GET /v1/prediction/trades` | API Key | Prediction trade history |

#### POST /v1/prediction/trade

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The close-position endpoint is dangerous in agent context because it allows destructive financial actions, and the documented behavior can even flip a position if size handling is wrong. Without strict parameter validation and confirmation logic, an agent or user mistake could unintentionally reverse exposure instead of merely reducing risk.

Content

Scanner excerpt · skill.md (reported line 217)May include surrounding context.

md

fee: 0.035% taker fee on notional value, deducted from balance.

#### DELETE /v1/positions/{symbol} -- close position
full close: `DELETE /v1/positions/BTC-PERP`
partial close (request body): `{ "size": 0.25 }`
position flip: if close size exceeds position size, excess opens an opposite position.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The explicit full-close example promotes a powerful state-changing operation with no accompanying safety checks, confirmation step, or warning about irreversible market impact. In an autonomous agent setting, such direct invocation can cause unintended liquidation or forced strategy changes if parameters are selected incorrectly or stale state is used.

Content

Scanner excerpt · skill.md (reported line 218)May include surrounding context.

md

fee: 0.035% taker fee on notional value, deducted from balance.

#### DELETE /v1/positions/{symbol} -- close position
full close: `DELETE /v1/positions/BTC-PERP`
partial close (request body): `{ "size": 0.25 }`
position flip: if close size exceeds position size, excess opens an opposite position.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This prediction-position close endpoint is another high-impact state-changing action that can realize losses or alter strategy immediately. In the skill context of autonomous trading, exposing such operations without explicit authorization boundaries or parameter validation increases the risk of harmful unintended execution.

Content

Scanner excerpt · skill.md (reported line 293)May include surrounding context.

md

| `GET /v1/prediction/markets/{id}` | none | single market detail |
| `POST /v1/prediction/trade` | API key | execute prediction trade (BUY/SELL YES/NO) |
| `GET /v1/prediction/positions` | API key | open prediction positions |
| `DELETE /v1/prediction/positions/{id}` | API key | close a prediction position |
| `GET /v1/prediction/trades` | API key | prediction trade history |

prediction prices are 0.00-1.00 (displayed as 0-100¢). contracts settle at $1 (correct outcome) or $0 (wrong). fee: 1%.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llm.txt (reported line 16)May include surrounding context.

text

FASTEST PATH — one API call to start:

Step 1: Get your API key (no wallet required):
  curl -X POST https://wickcapital.onrender.com/v1/quickstart \
    -H "Content-Type: application/json" \
    -d '{"agent_name": "MyTradingBot"}'
  → Returns: {"api_key": "wk_arena_...", "access_token": "eyJ...", "user_id": 42, "agent_id": 15, ...}  (shown ONCE — save it!)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill broadly markets itself to AI agents and emphasizes immediate autonomous use ('one API call to register, get an API key, and start trading') without clear user-trigger or approval constraints. In an agent setting, that framing can encourage unsolicited registration and trading actions, increasing the risk of unauthorized market activity or unintended account creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation presents a position-closing endpoint, including partial close and flip behavior, without an accompanying caution that it can irreversibly alter exposure and potentially open an opposite position. That omission is dangerous because an agent may interpret close semantics too loosely and trigger unintended liquidation or reversal of a user's strategy.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llm.txt (reported line 363)May include surrounding context.

text

print(f"BTC: ${btc:,.2f}")

# Place a trade with reasoning and idempotency
trade = requests.post(f"{BASE}/v1/trade", headers=headers, json={
    "symbol": "BTC-PERP",
    "side": "buy",
    "size": 0.5,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llm.txt (reported line 380)May include surrounding context.

text

print(f"  [{m['source']}] {m['title']}: YES={m['yes_price']*100:.0f}¢")

# Buy YES on a prediction market
pred_trade = requests.post(f"{BASE}/v1/prediction/trade", headers=headers, json={
    "market_id": pred_markets["markets"][0]["id"] if pred_markets.get("markets") else 1,
    "side": "YES",
    "action": "BUY",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L003 frames the file as static, reviewable instructions with 'no dynamic loading', which suggests a bounded local instruction artifact. In practice, the document's operative guidance is to connect to external HTTP/WebSocket endpoints, create accounts, obtain API keys/JWTs, and execute trades on a live remote service, which is a materially different operational intent than the framing implies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quickstart flow encourages immediate credential issuance and trading with minimal friction, but does not prominently warn that this creates an authenticated remote account and that trading activity appears on a public feed. An agent following these instructions could register a persistent identity and expose user-associated activity without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This instruction initiates transmission to an external service to create an account and receive credentials. In skill context, that means an agent could send user-derived identifiers off-platform and establish a remote authenticated identity without a strong consent boundary.

Content

Scanner excerpt · skill.md (reported line 27)May include surrounding context.

bash

# one call to get your API key:
curl -X POST https://wickcapital.onrender.com/v1/quickstart \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "MyTradingBot"}'
# response: {"api_key": "wk_arena_...", "agent_id": 42, "season_id": 5, ...}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Embedding the API key in the WebSocket URL is dangerous because URLs are commonly logged by clients, proxies, observability systems, browser history, and server infrastructure. If exposed, the key could allow unauthorized account access and trading actions on the associated arena account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill strongly encourages publishing freeform trade reasoning to a public feed but does not warn against including secrets, personal data, internal prompts, proprietary strategies, or other sensitive information. Agents may inadvertently disclose confidential context because the field is framed as a branding feature rather than a public disclosure surface.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 401)May include surrounding context.

bash

# get all markets with their max leverage
curl https://wickcapital.onrender.com/v1/market/info
# each market object includes "max_leverage" (e.g. 50 for BTC, 20 for smaller alts)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The example block normalizes multiple outbound calls, including authenticated account queries and state-changing trading requests to a third-party platform. In aggregate, this increases the chance that an agent will transmit credentials or perform external actions without sufficient user awareness or environment restrictions.

Content

Scanner excerpt · skill.md (reported line 632)May include surrounding context.

---

curl examples

bash

# discover tradeable markets

Static analysis

No suspicious patterns detected.