ClawHub
Back to skill

Security audit

polymarket-agent

Security checks for vulnerabilities and agentic risk

Overview

This is a real-money Polymarket trading skill, but its wallet custody and trading powers are clearly disclosed and guarded by dry-run defaults, confirmations, limits, encrypted storage, and audit logs.

Install only if you are comfortable with a skill that can custody a dedicated wallet key and place real-money Polymarket orders. Keep dry-run on while testing, fund only a wallet you can afford to lose, avoid POLYMARKET_KEY and POLYMARKET_PASSPHRASE unless necessary, review poly history, and use poly halt at the first sign of unexpected behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description emphasizes research with optional trading, but the documented behavior includes sensitive key custody operations: reading secrets from environment variables, prompting for passphrases, decrypting keys for signing, and deleting keystore files. That mismatch can cause operators or users to enable the skill under a lower-risk assumption than is warranted, which is especially dangerous because compromise or misuse could lead to irreversible financial loss.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_guardrails.py (reported line 263)May include surrounding context.

python
def test_unknown_keys_are_rejected(self):
        from polymarket_agent.config import ConfigError, _coerce

        for bad in ("../../secrets.env", "gateway.token", "__proto__"):
            with self.assertRaises(ConfigError):
                _coerce(bad, "x")

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_journal.py (reported line 172)May include surrounding context.

python
)
        holder = subprocess.Popen(
            [sys.executable, "-c", script],
            stdout=subprocess.PIPE, text=True, env=dict(os.environ),
        )
        try:
            self.assertEqual(holder.stdout.readline().strip(), "LOCKED")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises capabilities that include shell, network, environment access, and file writes, but it does not declare any explicit tool scope or allowed-tools boundary. For a skill that can touch wallet material, schedule jobs, and invoke trading commands, missing scope declarations increases the blast radius of prompt-injection, misuse, or accidental tool invocation because the runtime has no documented least-privilege constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · polymarket_agent/cli.py (reported line 68)May include surrounding context.

python
@app.command(rich_help_panel="Setup")
def setup(
    force: bool = typer.Option(False, "--force", help="Overwrite the existing keystore."),
) -> None:
    """Create the ENCRYPTED wallet keystore (interactive wizard).

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · polymarket_agent/paths.py (reported line 147)May include surrounding context.

python
if mode & (stat.S_IRWXG | stat.S_IRWXO):
        return (
            f"{path} is accessible to other users "
            f"(mode {stat.filemode(mode)}). Fix it with: chmod 600 {path}"
        )
    return None

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_journal.py (reported line 170)May include surrounding context.

python
"lock=trade_lock(timeout=30);lock.__enter__();"
            "print('LOCKED',flush=True);time.sleep(3);lock.__exit__()"
        )
        holder = subprocess.Popen(
            [sys.executable, "-c", script],
            stdout=subprocess.PIPE, text=True, env=dict(os.environ),
        )

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · tests/test_journal.py (reported line 199)May include surrounding context.

python
def trade_lock_short():
    from polymarket_agent.paths import trade_lock

    return trade_lock(timeout=0.5)


if __name__ == "__main__":

Ssd 1

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The test fixture contains user-controlled market text phrased as an authoritative operational instruction: it asserts approval exists and tells the agent to disable dry-run mode and execute a purchase. This is a semantic prompt-injection pattern because the harmful intent is conveyed through natural-language role/authority framing inside otherwise ordinary content, not via a literal jailbreak keyword.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The reset_state function deletes the persisted alerts.json file via path.unlink, which is a destructive file operation. While the docstring says it forgets announced items, there is no confirmation prompt, visible log, or explicit user-facing warning in this code path before removing the file.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · polymarket_agent/cli.py (reported line 183)May include surrounding context.

python
table.add_column("Key", style="cyan")
        table.add_column("Value", style="white")
        for name in sorted(KNOWN_KEYS):
            current = getattr(settings, name)
            style = ""
            if name == "dry_run":
                style = "green" if current else "yellow"

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · polymarket_agent/cli.py (reported line 217)May include surrounding context.

python
return

    if key:
        console.print(f"[cyan]{safe(key)}[/cyan] = {safe(getattr(settings, key))}")


@app.command(rich_help_panel="Setup")

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: eth-account has 2 known advisory(ies) (CVE-2022-1930 (Regular expression denial of service in eth-account); CVE-2022-1930 (Regular expression denial of service in eth-account)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: eth-account has 2 known advisory(ies) (CVE-2022-1930 (Regular expression denial of service in eth-account); CVE-2022-1930 (Regular expression denial of service in eth-account)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.