ClawHub
Back to skill

Security audit

Polymarket Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly disclosed Polymarket research and optional trading tool with real-money risks that are expected for its purpose and guarded by explicit controls.

Install only if you want a tool that can manage a dedicated Polymarket wallet and potentially place real orders. Keep dry-run on until tested, prefer the encrypted keystore over POLYMARKET_KEY, fund only a dedicated wallet with money you can lose, and avoid enabling autonomous mode unless you accept time-boxed orders without per-order confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises and documents capabilities to access environment variables, write files, invoke shell commands, and use the network, yet no explicit permissions model is declared. In a skill that can read wallet secrets, create cron jobs, and execute trading commands, this missing declaration weakens containment and auditability and can lead to over-privileged operation or unsafe invocation by the host.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# Only reaches out to the exchange if a credential exists — avoids a
    # network round-trip (and deriving API credentials) when the order would
    # be blocked anyway.
    if keystore.keystore_exists() or os.environ.get(keystore.LEGACY_KEY_ENV):
        try:
            balance_usd = trading.get_balance(settings)
        except trading.TradingError:
Confidence
81% confidence
Finding
The trading path treats the presence of a legacy private-key environment variable as sufficient to proceed toward authenticated exchange interaction. While this file does not exfiltrate the secret, supporting env-based credentials increases exposure because environment variables can leak to child processes, debugging tools, crash reports, or other local observers, especially in agent/runtime environments.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Read the user's balance, positions and orders | yes | financial read |
| **Custody a Polygon wallet private key** | yes | **high** |
| **Place buy/sell orders with real USDC** | yes | **high, irreversible** |
| **Autonomous mode (orders without confirmation)** | yes | **high, time-boxed and capped** |

**Losses are irreversible.** An on-chain transaction has no chargeback and no
support desk. Use a dedicated wallet holding only what the user accepts losing.
Confidence
79% confidence
Finding
The skill explicitly includes an autonomous mode capable of placing real-money orders without per-order confirmation. Even though the document describes caps and time limits, autonomous financial execution materially increases risk because prompt injection, misclassification, or logic bugs could still trigger irreversible trades.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
help="Required to ENABLE: confirms awareness of the financial risk.",
    ),
) -> None:
    """Enable/disable autonomous mode (orders without confirmation, WITH an expiry).

    Even enabled, every financial cap still applies and the kill switch
    still takes precedence.
Confidence
88% confidence
Finding
This skill can be configured to place real-money orders without per-order confirmation. In an agent context, autonomous financial actions are security-sensitive because prompt injection, logic bugs, or bad upstream data could trigger irreversible trades despite the documented guardrails.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
if not acknowledge:
        raise fail(
            "enabling autonomous mode requires --i-understand-the-risk. "
            "In this mode the agent sends real-money orders without asking."
        )
    if settings.dry_run is False and settings.max_position_usd > 100:
        console.print(
Confidence
90% confidence
Finding
The code explicitly acknowledges a mode where the agent sends real-money orders without asking, which materially increases the blast radius of any compromise, misconfiguration, or unsafe upstream decision. Because trades are irreversible and involve wallet-backed assets, this is a genuine operational security risk even if intentionally designed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.