polymarket-simmer-fastloop-sync-pulse

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.7

Overview

This appears to be a real Polymarket trading bot, but it needs manual review because it can trade with a wallet key and its automation, persistence, and spend-limit controls are not fully or consistently disclosed.

Install only if you intentionally want automated Polymarket trading. Start without WALLET_PRIVATE_KEY, use a dedicated low-balance wallet before live mode, verify the actual code/config variable names for max position and daily budget, and account for the five-minute managed schedule plus local files fast_markets_cache.json, daily_spend.json, and fastloop_ledger.json.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares access to sensitive resources via environment variables, local file reads/writes, and network APIs, but does not explicitly declare permissions. This undermines least-privilege review and can cause operators to run a skill without understanding that it can access API keys, persist local state, and communicate externally. In a trading skill that can run live with a wallet private key, hidden capabilities materially increase operational risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose understates the actual behavior by omitting persistent local storage, broader market window support, operational CLI modes, and live-trading execution details. Description/behavior mismatch is dangerous because users and automated platforms may approve the skill under an incomplete threat model, especially when it can write trade ledgers, track spending locally, and place real-money trades using a wallet private key. In financial automation, even benign undocumented behaviors can create significant security and safety exposure.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code embeds a hard-coded NOFX API auth token directly in outbound requests, exposing a reusable third-party credential to anyone who can read the skill, logs, or repository history. Hard-coded secrets are dangerous because they enable unauthorized API use, quota theft, and make revocation/rotation difficult; in this trading skill, the token is actively used for live signal generation, so the exposure is real rather than theoretical.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README states that the skill stores a local market cache file but does not clearly warn users that it creates persistent local data. While the cached market IDs are not highly sensitive by themselves, silent file creation can surprise operators, complicate sandboxing assumptions, and normalize undisclosed persistence in a skill that also tracks spend and trade activity. In aggregate with other local state files, this can expose user behavior or interfere with cleanup and reproducibility.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When run with --live and a wallet private key present, the skill can place real trades immediately with no explicit confirmation step, review gate, or interactive acknowledgement. In an automated trading skill handling real funds, that increases the risk of accidental execution, misconfiguration losses, or abuse if the skill is triggered unexpectedly or modified upstream.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.