ClawHub
Back to skill

Security audit

Polymarket

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Polymarket data lookup helper that queries public APIs and does not show hidden, destructive, credential-seeking, or persistent behavior.

Install only if you are comfortable with the agent running the bundled query script and sending your Polymarket search terms or IDs to Polymarket's public API. The skill does not need API keys and I found no evidence of persistence or local credential access; the main caveat is that one live-market command appears to have a Python bug.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Ae1

High
Category
analysis-evasion
Content
A PowerShell version (`scripts/polymarket_query.ps1`) is available in the [GitHub repository](https://github.com/Amurtiger01/polymarket-skill) but is not includ
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to execute a bundled Python script and also provides direct curl-based API fallback, which clearly requires network access. However, the manifest declares no explicit tool scope or allowed-tools/permissions, so an agent runtime may grant broader capabilities than intended or make network use insufficiently auditable. In this context the networking is expected for querying Polymarket, but the missing declaration still weakens least-privilege controls.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest explicitly says the skill can query live/in-play sports markets in real time, and the file documentation also exposes a `live` command for that purpose. However, `cmd_live` later relies on `datetime.timezone.utc`, but the module imports only `datetime` from `datetime`, so this reference will fail at runtime and the live-query behavior the skill claims to provide is not actually delivered.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This code performs outbound HTTP requests to Polymarket APIs through the generic fetch() helper, and several commands pass user-provided inputs such as search keywords, category slugs, event IDs, and market IDs into those requests. Although the module docstring says it queries public APIs, there is no runtime notice, prompt, or explicit user-facing warning that entered query terms will be sent over the network.

Static analysis

No suspicious patterns detected.