PolyGuard Martin Pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:05 AM UTC
• Version: 1.0.0

Overview

This skill is a real Polymarket auto-trader, but it can repeatedly place live financial orders with a stored API key and without clear built-in limits or confirmation.

Review carefully before installing. Only use narrowly scoped, revocable Polymarket credentials, avoid committing config.yaml after adding a real key, and do not run it with funds you cannot risk. The current artifact should be treated as live repeated trading automation, not a one-time alert or one-shot order tool.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:174

Finding

Unbounded Repeated Financial Transactions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: config.yaml:1

Finding

Trading Credential Stored in Plaintext Configuration

Content

View full analysis

SkillConfig: """Load and validate config from YAML. Reads only top-level keys.""" with open(path, "r", encoding="utf-8") as f: raw = yaml.safe_load(f) or {} api_key = str(raw.get("api_key") or "").strip() ``` The installation instructions explicitly direct users to place their Polymarket API key in this file. ### Technical Analysis The Skill expects a reusable trading credential to be stored in an ordinary plaintext file inside the project workspace. It provides no supported environment-variable or secret-manager mechanism, does not verify restrictive file permissions, and provides no source-control exclusion guidance. Although the repository contains only a placeholder rather than a live secret, following the documented installation procedure creates a sensitive local file. Workspaces are commonly copied, archived, synchronized, included in support bundles, or committed to source control. Any process or person able to read the workspace can recover the credential without defeating encryption or access controls. The credential's transmission to the hardcoded Polymarket API host is necessary for the declared remote-trading functionality. The storage method, however, is not the least-risk means of supplying that credential. ### Attack Path 1. The user follows the documentation and replaces the placeholder in `config.yaml` with a live trading credential. 2. The configuration file remains readable as plaintext in the project workspace. 3. The workspace is committed, shared, backed up, synchronized, included in logs or support archives, or read by another local user or process. 4. The exposed creden ...[truncated 563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:52

Finding

Missing Validation of Financial and Polling Parameters

Content

View full analysis

bool: """True if current price meets the configured threshold for the chosen side.""" if cfg.side == "buy": return price <= cfg.max_price return price >= cfg.max_price ``` ### Technical Analysis Configuration values are converted to strings or floating-point numbers but are not checked against safe semantic constraints. Specifically: - `side` is not restricted to `buy` or `sell`. - Any value other than exactly `buy` follows the sell-side threshold branch. - `size` is not required to be positive or bounded. - `max_price` is not checked against the market's valid price range. - `poll_interval_seconds` is not required to be positive and has no safe minimum. - The manifest schema declares broad string and number types but does not define a side enumeration or numeric bounds. As a result, malformed, accidentally edited, or externally supplied configuration can reach financial decision logic and order construction. A zero or negative polling interval can also cause immediate failures or excessive request frequency. ### Attack Path 1. A user, deployment process, or party capable of modifying `config.yaml` supplies an invalid value, such as a misspelled side, an excessive size, an out-of-range threshold, or an unsafe polling interval. 2. `load_config` accepts the value because it performs type conversion without semantic validation. 3. A misspelled side ...[truncated 1038 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The main loop continuously monitors prices and automatically places live orders as soon as the threshold is met, with no confirmation prompt, dry-run mode, kill switch, or prominent warning that real funds may be used. In an agent-skill context, this is especially dangerous because users may invoke the skill expecting analysis or monitoring, but the code can execute irreversible financial actions immediately and repeatedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring makes a trust-building claim that the skill performs 'No data collection; no hidden backdoors,' yet the code sends API credentials in Authorization headers and transmits trading/order data to external Polymarket endpoints. Even if those transmissions are functionally required, the misleading assurance can cause users to underestimate the sensitivity of what the skill sends off-host and approve use without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 143)May include surrounding context.

python

url = f"{POLYMARKET_BASE_URL}/v1/trading/orders"
    try:
        resp = requests.post(url, headers=headers, json=order_body, timeout=15)
    except requests.RequestException as e:
        raise RuntimeError(f"Order request failed: {e}") from e

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest states 'No data collection' while the skill explicitly requires an API key, which is sensitive credential material. Even if the key is only used locally for trading, the claim is misleading and can cause users to underestimate privacy and account-risk implications of supplying credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This manifest advertises automated trading but omits clear warnings that the skill can place potentially irreversible trades using the user's API key. In a trading context, missing risk disclosure is more dangerous because users may enable automation without understanding financial loss, account misuse, or credential exposure risks.

Content

No source excerpt is available for this finding.