Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Polymarket data lookup helper that queries public APIs and does not show hidden, destructive, credential-seeking, or persistent behavior.
Install only if you are comfortable with the agent running the bundled query script and sending your Polymarket search terms or IDs to Polymarket's public API. The skill does not need API keys and I found no evidence of persistence or local credential access; the main caveat is that one live-market command appears to have a Python bug.
Referenced artifact was not completely inspected
A PowerShell version (`scripts/polymarket_query.ps1`) is available in the [GitHub repository](https://github.com/Amurtiger01/polymarket-skill) but is not includ
The skill instructs the agent to execute a bundled Python script and also provides direct curl-based API fallback, which clearly requires network access. However, the manifest declares no explicit tool scope or allowed-tools/permissions, so an agent runtime may grant broader capabilities than intended or make network use insufficiently auditable. In this context the networking is expected for querying Polymarket, but the missing declaration still weakens least-privilege controls.
The manifest explicitly says the skill can query live/in-play sports markets in real time, and the file documentation also exposes a live command for that purpose. However, cmd_live later relies on datetime.timezone.utc, but the module imports only datetime from datetime, so this reference will fail at runtime and the live-query behavior the skill claims to provide is not actually delivered.
This code performs outbound HTTP requests to Polymarket APIs through the generic fetch() helper, and several commands pass user-provided inputs such as search keywords, category slugs, event IDs, and market IDs into those requests. Although the module docstring says it queries public APIs, there is no runtime notice, prompt, or explicit user-facing warning that entered query terms will be sent over the network.