Polymarket World Cup Group Favorites Repricing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its World Cup prediction-market trading purpose, but it uses a sensitive Simmer API key for live trading/account access and relies on an unpinned trading SDK dependency.

Review this before installing if you plan to use live mode. Use a least-privilege Simmer API key with spending or trading limits, start in dry-run or sim mode, consider pinning simmer-sdk to a reviewed version, and be aware that the bundled status script can display account balances and positions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:8

Finding

Security-Sensitive Dependency Is Not Pinned to a Reviewed Version

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:8-10
Vulnerability Type: Unbounded third-party dependency version
Risk Level: Medium

json

"pip": [
  "simmer-sdk>=0.17.1"
]

Technical Analysis

The project accepts any future simmer-sdk release whose version is at least 0.17.1. It does not specify an exact reviewed version, package hash, lock file, or trusted-index constraint.

This dependency operates in a security-sensitive context. The main program imports SimmerClient, gives it the SIMMER_API_KEY, retrieves account and market information, and can place live trades. A future compromised, malicious, or unexpectedly incompatible package release accepted by this version constraint would execute with the same process privileges and could access credentials, local files, network resources, and trading operations.

The audit did not find evidence that the currently referenced package or version is malicious. The vulnerability is the uncontrolled trust placed in future releases.

Attack Path

1. An attacker compromises the dependency publisher, package repository, or release process for simmer-sdk.
2. The attacker publishes a higher version satisfying simmer-sdk>=0.17.1.
3. A user or deployment environment installs or updates the Skill without a locked dependency set and integrity verification.
4. The package manager selects the attacker-controlled release.
5. The main script imports code from the installed package.
6. The malicious dependency executes in the Skill process and can access SIMMER_API_KEY when the client is initialized.
7. It may exfiltrate the credential, manipulate returned market information, inspect account positions, or submit unauthorized trading requests.

Impact Assessment

Successful exploitation could provide access equivalent to the Skill process, including:

• Reading the Simmer API credential available to the process.
• Accessing portfo ...[truncated 482 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended constraint with an exact, reviewed version:

   json

   "pip": [
     "simmer-sdk==0.17.1"
   ]
   

2. Use a lock file containing hashes for the complete transitive dependency graph.
3. Require hash-verified installation, such as pip install --require-hashes.
4. Restrict dependency retrieval to an explicitly trusted package index.
5. Review dependency source and release changes before upgrading the pinned version.
6. Run the Skill in a minimally privileged environment with restricted filesystem and network access.
7. Scope the API key to only the account and trading permissions required by this Skill, with server-side spending limits where supported.
8. Rotate the API key promptly if a dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 132, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · world_cup_group_favorites_repricing.py (reported line 138)May include surrounding context.

python

)

    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            data = json.loads(r.read().decode())
    except Exception:
        return []

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a narrow World Cup trading strategy, but the detected behavior instead includes authenticated account/portfolio retrieval and lacks the advertised sports-specific trading logic. This mismatch is dangerous because users and reviewers may approve the skill expecting benign market analysis while it quietly exercises sensitive account access, enabling surveillance of balances/positions or preparation for unauthorized downstream actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script's declared purpose is to inspect a Simmer trading account, which is unrelated to the advertised Polymarket World Cup repricing strategy. In an agent skill, this kind of capability mismatch is dangerous because it can cause operators to expose unrelated credentials and account data under false pretenses, creating an opportunity for unintended account access or data collection.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions even though its detected capabilities include environment access, file read/write, and network access. In an agent-executed context, this creates unnecessary authority and weakens reviewability, making it easier for the skill to access secrets, modify local state, or reach external services without clear user-visible authorization boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest requires a sensitive API credential and clearly enables a managed automation entrypoint, but it does not disclose to users that the skill will perform networked actions using their key. This creates a real transparency and consent problem: users may supply credentials without understanding that the skill can make remote API calls and potentially place automated trades or consume paid API resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code reads a separate SIMMER_API_KEY and calls Simmer account endpoints despite the skill being presented as a Polymarket World Cup strategy. This discrepancy increases risk because a user may supply sensitive credentials for an unrelated service, enabling unauthorized visibility into balances, exposure, and positions and potentially normalizing hidden cross-account access in agent skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · world_cup_group_favorites_repricing.py (reported line 131)May include surrounding context.

python

"limit": max(1, min(limit, 1000)),
        }
    )
    url = f"https://api.simmer.markets/api/sdk/markets?{params}"
    req = urllib.request.Request(
        url,
        headers={"Authorization": f"Bearer {key}", "Accept": "application/json"},

Static analysis

No suspicious patterns detected.