polymarket-simmer-fastloop-sync-pulse

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:44 PM UTC
• Version: 1.0.7

Overview

The skill largely matches its trading purpose, but it can automate real-money Polymarket trades using a wallet key and has weak scoping, dependency, secret, and budget controls that require review before installation.

Review this before installing as a live trading skill. Use only a dedicated low-balance wallet, avoid setting WALLET_PRIVATE_KEY unless you intend real-money trading, pin and audit simmer-sdk, rotate/remove the embedded NOFX credential, and require stronger live-trade confirmation plus atomic budget enforcement before relying on the daily limit.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: fastloop_improved.py:169
• Finding: Unpinned Third-Party Dependency Receives the Wallet Private Key<![CDATA[ ## Vulnerability Details **File Location**: `fastloop_improved.py:169-190`; dependency declarations in `SKILL.md:12-15` and `clawhub.json:2-9` **Vulnerability Type**: Supply-chain exposure of a high-value secret **Risk Level**: High ### Vulnerable Code ```python def get_client(live=True, discovery=False): global _client, _discovery_client # New V8.9.3: Discovery Client always uses real-market venue to avoid scanning "empty" sim servers if discovery: if _discovery_client is None: from simmer_sdk import SimmerClient api_key = os.environ.get("SIMMER_API_KEY") if not api_key: print("Error: SIMMER_API_KEY for discovery not set"); sys.exit(1) # Discovery doesn't need a wallet or live-signing _discovery_client = SimmerClient(api_key=api_key, venue="polymarket", live=True) return _discovery_client if _client is None: from simmer_sdk import SimmerClient api_key = os.environ.get("SIMMER_API_KEY") if not api_key: print("Error: SIMMER_API_KEY not set"); sys.exit(1) priv_key = os.environ.get("WALLET_PRIVATE_KEY") venue = "polymarket" if priv_key else "sim" if priv_key: print(f"🔐 Wallet Private Key detected. Mode: {venue.upper()} (LIVE: {live})") else: print(f"🍦 No Wallet Private Key. Mode: SIMULATION (Dry Run: {live})") _client = SimmerClient(api_key=api_key, venue=venue, live=live, private_key=priv_key) ``` The dependency is declared without a version or integrity constraint: ```yaml pip: - simmer-sdk ``` ```json { "requires": { "pip": [ "simmer-sdk" ], "env": [ "SIMMER_API_KEY", "WALLET_PRIVATE_KEY" ] } } ``` ### Technical Analysis The Skill reads `WALLET_PRIVATE_KEY` from the environment and passes the raw value directly into `SimmerClient`, which is imported from the externally installed `simmer-sdk` package. Th ...[truncated 1776 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `simmer-sdk` to an exact, reviewed version rather than allowing unconstrained upgrades. 2. Require package integrity hashes, such as with a hash-locked requirements file. 3. Audit the SDK code paths that accept `api_key` and `private_key`, including all network operations. 4. Prefer an isolated signing component or hardware wallet that exposes only a narrowly scoped signing interface rather than the raw private key. 5. Run discovery without loading `WALLET_PRIVATE_KEY`; load signing capability only immediately before an explicitly authorized live trade. 6. Restrict outbound network access for the signing process to documented and approved endpoints. 7. Monitor dependency ownership and release changes and require review before version upgrades. 8. Use a dedicated low-balance trading wallet with narrowly scoped approvals to limit losses if the signing boundary is compromised. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: fastloop_improved.py:359
• Finding: Hardcoded NOFX API Credential Exposed in Source and URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `fastloop_improved.py:359-378` **Vulnerability Type**: Hardcoded credential and insecure credential transport location **Risk Level**: Medium ### Vulnerable Code ```python def fetch_nofx_oi(asset="BTC", duration="5m"): sym = ASSET_SYMBOLS.get(asset, "BTCUSDT") # Rule: Check both Top (Increase) and Low (Decrease) rankings for rank_type in ["top-ranking", "low-ranking"]: url = f"https://nofxos.ai/api/oi/{rank_type}?auth=cm_568c67eae410d912c54c&duration={duration}" res = _api_request(url) if res and "data" in res and "positions" in res["data"]: for i in res['data']['positions']: if i['symbol'] == sym: return float(i.get('oi_delta_percent', 0.0)) * 100 return 0.0 def fetch_nofx_netflow(asset="BTC", duration="5m"): sym = ASSET_SYMBOLS.get(asset, "BTCUSDT") # Rule: Check both Top (Inflow) and Low (Outflow) rankings # Institution type is mandatory per user blueprint for rank_type in ["top-ranking", "low-ranking"]: url = f"https://nofxos.ai/api/netflow/{rank_type}?auth=cm_568c67eae410d912c54c&type=institution&duration={duration}" res = _api_request(url) if res and "data" in res and "netflows" in res["data"]: for i in res['data']['netflows']: if i['symbol'] == sym: amt = float(i.get('amount', 0.0)) ``` ### Technical Analysis A credential-like NOFX authentication token is embedded directly in the distributed source code. Anyone who can read the Skill package can recover and reuse it. The token is additionally placed in the query string. Although the request uses HTTPS, query strings are commonly retained by application servers, reverse proxies, monitoring systems, browser or HTTP tooling, and access logs. This creates more disclosure locations than an authorization header would. The NOFX calls are related to the declared trading strategy, but embedding a shar ...[truncated 1151 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed token. 2. Remove the token from source code and version history. 3. Obtain the token from a dedicated environment variable or secrets manager. 4. Send credentials in an `Authorization` header rather than a URL query parameter, if supported by NOFX. 5. Use a separate, least-privileged token for this Skill with restrictive quotas and read-only permissions. 6. Ensure HTTP clients, proxies, and monitoring systems redact authentication headers and sensitive URL parameters. 7. Fail safely when the credential is absent or the API is unavailable rather than silently treating unavailable data as a valid zero-valued signal. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: fastloop_improved.py:603
• Finding: Non-Atomic Daily Budget Enforcement Allows Concurrent Overspending<![CDATA[ ## Vulnerability Details **File Location**: `fastloop_improved.py:129-151` and `fastloop_improved.py:603-620`; scheduled execution in `clawhub.json:11-15` **Vulnerability Type**: Race condition in financial safety controls **Risk Level**: High ### Vulnerable Code The budget state is stored in an unlocked JSON file: ```python def _get_spend_path(skill_file): from pathlib import Path return Path(skill_file).parent / "daily_spend.json" def _load_daily_spend(skill_file): path = _get_spend_path(skill_file) today = datetime.now(timezone.utc).strftime("%Y-%m-%d") if path.exists(): try: with open(path) as f: data = json.load(f) if data.get("date") == today: return data except Exception: pass return {"date": today, "spent": 0.0, "trades": 0} def _save_daily_spend(skill_file, data): with open(_get_spend_path(skill_file), "w") as f: json.dump(data, f, indent=2) ``` The balance is checked before trading, but it is updated only after a successful order: ```python # 5. Sizing & Execution p_size = min(calculate_position_size(mom), DAILY_BUDGET - daily_spend["spent"]) if p_size < 1.0: log(" ⏸️ Budget low. Skip.", force=True) _emit_skip_report(1, 1, 0, skips=["budget_low"]); return log(f" ✅ Executing ${p_size:.2f} on {side.upper()}...", force=True) try: result = client.trade( market_id=target_market_id, side=side, amount=p_size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reason ) if result.success: log(f" 💰 Success! Bought {result.shares_bought:.1f} shares.", force=True) if not result.simulated: daily_spend["spent"] += p_size; daily_spend["trades"] += 1 _save_daily_spend(__file__, daily_spend) ``` The manifest schedules managed executions every five minutes: ```json "cron": "*/5 * * * *", "automaton": { "managed": true, "entrypoint": "fastloop_improved ...[truncated 2112 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Protect the complete budget-check, reservation, order-submission, and reconciliation workflow with an inter-process lock. 2. Reserve the intended amount atomically before submitting the order. 3. Release or reconcile the reservation if submission fails. 4. Store spending state in a transactional database or another storage system that supports atomic conditional updates. 5. If a file must be used, write to a temporary file, flush and synchronize it, and atomically replace the prior state while holding an exclusive lock. 6. Treat malformed or unavailable budget state as a fail-closed condition that blocks live trading; never reset spending to zero silently. 7. Prevent overlapping scheduler executions through a singleton process lock. 8. Reconcile local spending against authoritative venue order and transaction records before allowing additional live trades. 9. Add concurrency tests that launch multiple trading processes against the same remaining budget. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented behavior does not fully match the described scope: the skill reportedly supports additional time windows, extra market discovery sources, and undeclared persistent local ledgers/state beyond the advertised strategy. For a trading skill handling API credentials and an optional wallet private key, hidden or underdocumented behaviors materially increase operational risk because reviewers may approve it under false assumptions about where data is sent, what gets stored, and when trades can occur.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The script enables real-money trading solely through a --live flag and immediately executes strategy logic without an interactive confirmation, explicit risk acknowledgment, or final pre-trade guard. In the context of an automated trading skill that can also pick up a wallet private key from the environment, this increases the chance of accidental live execution and financial loss from operator mistake, automation misconfiguration, or malicious invocation by another component.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares access to sensitive capabilities through behavior implied in the documentation—environment secrets, local file read/write, and network access—but does not scope or declare those permissions explicitly. In an agent ecosystem, this weakens least-privilege controls and informed review, increasing the chance that API keys, wallet material, or local state files are exposed or misused by an overprivileged runtime.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The script reads `WALLET_PRIVATE_KEY` from the environment to enable live trading, but the file does not include a docstring, comment, or warning explaining the sensitivity of this credential or the consequences of providing it. Accessing private keys is safety-critical because it changes the execution mode and can authorize real financial actions.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code embeds a hard-coded NOFX API credential directly in outbound requests, which exposes secret material to anyone with file access and makes unauthorized reuse trivial. In a trading skill, this also creates operational risk because the credential can be harvested, abused, revoked, or tied back to the operator, disrupting service and potentially incurring account-level consequences.

External Transmission

Medium

• Category: Data Exfiltration

Content

def fetch_binance_orderbook(asset="BTC", limit=100):
    url = f"https://api.binance.com/api/v3/depth?symbol={ASSET_SYMBOLS.get(asset, 'BTCUSDT')}&limit={limit}"
    res = _api_request(url)
    if not res or "bids" not in res: return None
    bids, asks = [[float(i[0]), float(i[1])] for i in res["bids"]], [[float(i[0]), float(i[1])] for i in res["asks"]]

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

def fetch_binance_orderbook(asset="BTC", limit=100):
    url = f"https://api.binance.com/api/v3/depth?symbol={ASSET_SYMBOLS.get(asset, 'BTCUSDT')}&limit={limit}"
    res = _api_request(url)
    if not res or "bids" not in res: return None
    bids, asks = [[float(i[0]), float(i[1])] for i in res["bids"]], [[float(i[0]), float(i[1])] for i in res["asks"]]

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: When no wallet key is present, the code logs `SIMULATION (Dry Run: {live})`, but `live` is passed directly from `get_client(live=not dry_run)`, so a dry run corresponds to `live=False`, not `live=True`. This comment/logging intent is actively misleading about whether execution is a dry run versus live client mode.

Static analysis

No suspicious patterns detected.