T06 · System Persistence
Error
- Location
clawhub.json:7- Finding
Undisclosed Hourly Managed Execution Creates Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Sports Edge
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it advertises, but it can run as an undisclosed hourly trading automaton with real-money authority when live mode is enabled.
Review this carefully before installing. Use dry-run first, avoid setting LIVE=true in any environment where scheduled jobs may inherit it, set small trade and quota limits, and rotate keys if full request URLs might be logged. The publisher should document or disable the hourly automation, pin dependencies, remove duplicate stale package copies, and align documented defaults with code before this is suitable for unattended live trading.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T08 · Insecure Dependencies
Warning
- Location
clawhub.json:4- Finding
Security-Critical Runtime Dependencies Are Unpinned
- Content
View full analysis
- Remediation
View remediation
` and `simmer-sdk==`. 2. Use a lockfile or requirements file containing cryptographic hashes. 3. Install only from an explicitly trusted package index. 4. Review package ownership, release history, and transitive dependencies before upgrades. 5. Test upgrades in an isolated environment before deploying them to a process with live-trading credentials. 6. Restrict the runtime environment so dependencies can access only the required credentials and network destinations. 7. Separate read-only market-data credentials from credentials capable of financial transactions wherever the service supports it. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
sports_edge.py:122- Finding
Odds API Credential Is Transmitted in URL Query Parameters
- Content
View full analysis
`. TLS protects the URL while it is in transit to the intended service, and the destination is consistent with the Skill’s declared functionality. Therefore, this is not evidence of covert exfiltration to an attacker-controlled host. However, query strings are commonly retained by application servers, reverse proxies, debugging tools, monitoring systems, HTTP traces, and exception reporting. Anyone with access to those records may recover the key. URL-based credentials also have a higher accide ...[truncated 855 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
test_odds.py:6- Finding
Test Modules Perform Authenticated External Requests During Import
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/polymarket-sports-edge/sports_edge.py:21- Finding
Documented Financial Risk Defaults Do Not Match Executed Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tainted flow: 'API_TIMEOUT' from os.environ.get (line 24, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python api_key = os.environ["SIMMER_API_KEY"] for attempt in range(retries + 1): try: resp = requests.get( "https://api.simmer.markets/api/sdk/markets", headers={"Authorization": f"Bearer {api_key}"}, params={"q": query, "status": "active", "limit": 50},
Tainted flow: 'API_TIMEOUT' from os.environ.get (line 24, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python api_key = os.environ["SIMMER_API_KEY"] for attempt in range(retries + 1): try: resp = requests.get( "https://api.simmer.markets/api/sdk/markets", headers={"Authorization": f"Bearer {api_key}"}, params={"q": query, "status": "active", "limit": 50},
Tainted flow: 'params' from os.environ (line 118, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "markets": market_type, "oddsFormat": "decimal", } resp = requests.get(url, params=params, timeout=API_TIMEOUT) if resp.status_code == 422: # Sport not currently in season return []
Tainted flow: 'params' from os.environ (line 125, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "markets": market_type, "oddsFormat": "decimal", } resp = requests.get(url, params=params, timeout=API_TIMEOUT) if resp.status_code == 422: # Sport not currently in season return []
Tainted flow: 'api_key' from os.environ (line 6, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"}, timeout=15,
Tainted flow: 'api_key' from os.environ (line 6, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"}, timeout=15,
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This second description-behavior mismatch finding highlights the same core issue from a slightly different angle: the skill promises Polymarket interaction, divergence detection, and order placement, yet those capabilities are not evidenced in the provided artifact. In a financial-trading context, misleading capability claims can cause users to expose API keys, enable live mode, or rely on automation that may not behave as expected.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This second description-behavior mismatch finding highlights the same core issue from a slightly different angle: the skill promises Polymarket interaction, divergence detection, and order placement, yet those capabilities are not evidenced in the provided artifact. In a financial-trading context, misleading capability claims can cause users to expose API keys, enable live mode, or rely on automation that may not behave as expected.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents use of environment variables and external HTTP APIs but does not declare any explicit tool scope or permissions. That creates a transparency and governance gap: an agent may be allowed to access network and secrets without the skill clearly signaling those capabilities to reviewers or users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill discusses switching to LIVE mode for automated market actions but lacks an explicit warning about real-money risk and automated execution. In a trading context, omission of clear risk disclosures can lead users to enable live trading without understanding loss potential, liquidity constraints, or automation hazards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Live trading is enabled solely by setting the LIVE environment variable to true, with no interactive confirmation, approval gate, or secondary safeguard before placing real-money trades. In an agent or automation context, a misconfiguration, inherited environment, or unreviewed deployment could cause unintended real trades and direct financial loss.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python for attempt in range(retries + 1): try: resp = requests.get( "https://api.simmer.markets/api/sdk/markets", headers={"Authorization": f"Bearer {api_key}"}, params={"q": query, "status": "active", "limit": 50}, timeout=API_TIMEOUT,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python for attempt in range(retries + 1): try: resp = requests.get( "https://api.simmer.markets/api/sdk/markets", headers={"Authorization": f"Bearer {api_key}"}, params={"q": query, "status": "active", "limit": 50}, timeout=API_TIMEOUT,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill can place and liquidate live trades automatically whenever LIVE=true, based solely on external market data and internal heuristics, without any explicit user confirmation, max-loss guardrail, or secondary approval step. In an agent setting, this creates a real risk of unauthorized or unintended financial activity if the skill is invoked unexpectedly, misconfigured, or fed bad market matches.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"},
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"},
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"},
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ] for sport in sports: url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/" resp = requests.get( url, params={"apiKey": api_key, "regions": "us", "markets": "h2h", "oddsFormat": "decimal"},
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The first-run setup text says the default resolution window is 90 days, but the environment variables table earlier defines
MAX_RESOLVE_DAYSdefault as30. This is an active documentation contradiction about a trading constraint, which can mislead users about the skill's actual behavior and risk horizon.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The code reads SIMMER_API_KEY to authenticate against external services, and also reads THE_ODDS_API_KEY elsewhere, but does not include comments or user-facing disclosure describing that the skill depends on and uses these credentials. For this rule, sensitive credential access without any disclosure can warrant a finding.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The code performs HTTP requests to Simmer and The Odds API, including authorization headers and query parameters derived from configured sports/market searches. While the operations are logged on errors and retries, there is no explicit disclosure in code comments or documentation text warning that the skill transmits data to third-party services.
- Content
Static analysis
No suspicious patterns detected.