UniClaw Prediction Market

Trade on UniClaw prediction markets. Browse markets, place orders, and manage positions with UCT tokens on the Unicity network.

Before installing or running this skill, consider: (1) It will read your Unicity wallet (mnemonic/private key) and use that key to sign requests and send tokens — only run this if you fully trust the UniClaw server. (2) The code contains a hard-coded UNICITY_API_KEY default; ask the maintainer what that key is for, rotate or remove it if it is a real secret, and prefer supplying your own API key via environment variable. (3) If you want to reduce blast radius, use a separate test wallet with minimal funds (not your main wallet) or run the skill against a self-hosted UniClaw server (set UNICLAW_SERVER). (4) The code accesses an internal SDK field to extract privateKey — review that choice and prefer an SDK API that doesn't expose private keys if possible. If you need higher assurance, request the server's source code or run the client against a server you control; otherwise treat this skill as sensitive and proceed cautiously.

Type: OpenClaw Skill Name: uniclaw Version: 0.2.1 The skill is classified as suspicious due to several vulnerabilities, though it lacks clear evidence of intentional malice. Key concerns include the ability to override the `UNICLAW_SERVER` environment variable (lib/config.ts), which could redirect cryptographically signed API requests to an attacker-controlled server. Additionally, the `scripts/withdraw.ts` functionality allows sending tokens to an arbitrary address, presenting a significant prompt injection risk against the AI agent. A hardcoded `UNICITY_API_KEY` (lib/wallet.ts) for an oracle is also present, which could be a minor vulnerability depending on its privileges. While these are vulnerabilities and potential attack surfaces, the skill's code and instructions (SKILL.md) are transparently aligned with its stated purpose of interacting with a prediction market, and do not contain explicit malicious commands or data exfiltration attempts.