T09 · Insecure Skill Coding Practices
Warning
- Location
btc_15m.cjs:31- Finding
Unnecessary Plaintext Wallet Private-Key Handling
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Alpha Suite
Security checks for vulnerabilities and agentic risk
Overview
This trading skill should be reviewed carefully because it asks for sensitive trading and wallet credentials while advertising live automation that the reviewed code does not actually implement.
Install only if you are comfortable reviewing a financial trading tool yourself. Do not provide a wallet private key or live trading credentials to this version; based on the inspected code, it appears suitable only for public-data scanning and dry-run signal logging. Expect local JSON files to be written under the skill directory, and avoid cron/nohup background runs unless you intentionally want continuous monitoring.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 1. NegRisk Arbitrage Scanner (`negrisk_scanner.cjs`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Latency Arbitrage Bot (`latency_arb.cjs`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 4. Alpha Scanner (`alpha_scan.cjs`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 5. Universe Scanner (`universe_scanner.cjs`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 6. Edge Finder (`edge_finder.cjs`)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The header comments and usage examples explicitly state that the tool places trades and supports continuous trading, but the implementation contains no live execution path. In a financial trading skill, this mismatch is more dangerous than in ordinary software because users may deploy it expecting autonomous market actions while nothing is actually executed, causing missed hedges, stale positions, or incorrect assumptions about risk coverage.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest advertises 'NegRisk arbitrage (100% win rate),' while this latency arbitrage file estimates fair value via a sigmoid-based heuristic over recent BTC price changes rather than a risk-free arbitrage mechanism. The code explicitly resolves signals as either won or lost and tracks PnL, showing the strategy is speculative and fallible rather than guaranteed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes executing Node.js programs that use network access and environment variables, but it declares no explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host agent or user may not understand the skill’s required capabilities before invocation, increasing the risk of unintended secret exposure or network activity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The live trading setup instructs users to place API credentials and private keys in environment variables or a .env file, but it does not include a strong warning about secret handling, storage, logging, or source-control exposure. In a trading context, leaked credentials could enable unauthorized account access, order placement, or theft of funds.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
*/15 * * * * cd /path/to/polymarket-alpha && node negrisk_scanner.cjs scan >> logs/negrisk.log 2>&1
Continuous monitoring (keep running)
nohup node latency_arb.cjs watch --dry > logs/latency.log 2>&1 &
text ### Data Export
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The header advertises multiple signal types such as time decay and momentum, but the code only performs simple market filtering by price, expiry, and volume. In a trading skill, overstating implemented analytics can mislead users into trusting outputs as institutional-grade signals, increasing the chance of poor financial decisions based on nonexistent analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comment and output framing describe near-expiry markets as 'high confidence' and having a 'clear winner', but the actual code only checks days-to-expiry and volume, then visually flags extreme prices. This creates unjustified authority around the recommendations and can cause users to infer predictive validation that the script does not perform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script ends with actionable trading instructions and promotional framing but provides no warning that outputs are heuristic, unvalidated, and financially risky. In the context of a trading tool marketed as battle-tested and institutional-grade, omission of a disclaimer materially increases the risk that users will treat the output as reliable investment advice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js async function getBTCMomentum() { try { // Use Hyperliquid for real-time BTC data (no rate limit) const r = await fetch('https://api.hyperliquid.xyz/info', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ type: 'candleSnapshot', req: { coin: 'BTC', interval: '5m', startTime: Date.now() - 3600000 } })
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The tool presents itself as a trading utility and the trade path computes signals, sizes positions, and records a trade, but it never actually submits a live order even when credentials are present. This is a security-relevant integrity issue because users may rely on it for automated execution while the system silently only logs dry-run entries, creating a false sense of action and potentially leading to unmanaged market exposure or bad operational decisions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The header describes a demo of the suite's 6 tools, and the printed summary at L047 advertises 'whale tracking'. However, the actual
toolsarray does not include any whale-tracking tool; it includes 'Universe Scanner' and 'Edge Finder' instead. This is an active contradiction between the file's stated overview and what the code actually demos.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest markets 'NegRisk arbitrage (100% win rate)' and 'battle-tested on 8,347 signals', but this file prints broader suite performance of '73.4% win rate' over 8,347 signals. Because this demo file presents those numbers as representative suite outcomes, it conflicts with the stronger success claim associated with the suite description.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js // --- Config --- const GAMMA_BASE = 'https://gamma-api.polymarket.com'; const HL_API = 'https://api.hyperliquid.xyz/info'; const DATA_DIR = path.join(__dirname, 'data'); const SIGNALS_FILE = path.join(DATA_DIR, 'latency_arb_signals.json'); const POLL_MS = 5000; // Poll every 5 seconds
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js // --- Config --- const GAMMA_BASE = 'https://gamma-api.polymarket.com'; const HL_API = 'https://api.hyperliquid.xyz/info'; const DATA_DIR = path.join(__dirname, 'data'); const SIGNALS_FILE = path.join(DATA_DIR, 'latency_arb_signals.json'); const POLL_MS = 5000; // Poll every 5 seconds
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script persistently writes signal history to a local JSON file without clear user notice or consent. While the stored data is limited, silent local persistence can expose trading behavior and timestamps to other local users, backups, or shared environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes an 'institutional-grade' Polymarket trading suite including latency arbitrage, which implies actual trade execution capability. In this file, the watch flow computes divergences, prints 'BUY' recommendations, marks them as 'Theoretical,' and persists dry-run/live signal records locally, but never submits orders to Polymarket or any exchange.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script prints trading guidance such as 'potential high-return asymmetric bets' and 'time-decay alpha' that encourages speculative betting behavior without any risk disclosure, suitability warning, or jurisdiction/compliance notice. In a trading-focused skill marketed as 'institutional-grade' and 'battle-tested,' this language can materially nudge users toward risky financial activity while omitting important safety context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The README advertises commands like
node universe_scanner.cjs --savebut does not clearly warn users that running them may persist market data to disk. While this is not an exploit by itself, it can create unexpected local data retention, privacy, or operational issues for users who assume scans are ephemeral, especially when API-derived data is written automatically.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation notes JSON output and auto-created data files, but it does not clearly warn users that running the tools may persist market scans, signals, or trade history to local storage. Silent persistence can expose sensitive operational data on shared machines or leave behind artifacts that users did not expect.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The script persists trade history to a JSON file via saveTrade(), which writes under the local data directory. Although the code logs dry-run/live status, it does not clearly disclose to the user at the point of operation that trade metadata will be stored on disk, which is a data-affecting action.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- demo.cjs:12
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- btc_15m.cjs:32