polymarket-simmer-fastloop-sync-pulse

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:44 PM UTC
• Version: 1.0.7

Overview

The skill largely matches its trading purpose, but it can automate real-money Polymarket trades using a wallet key and has weak scoping, dependency, secret, and budget controls that require review before installation.

Review this before installing as a live trading skill. Use only a dedicated low-balance wallet, avoid setting WALLET_PRIVATE_KEY unless you intend real-money trading, pin and audit simmer-sdk, rotate/remove the embedded NOFX credential, and require stronger live-trade confirmation plus atomic budget enforcement before relying on the daily limit.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: fastloop_improved.py:169

Finding

Unpinned Third-Party Dependency Receives the Wallet Private Key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: fastloop_improved.py:359

Finding

Hardcoded NOFX API Credential Exposed in Source and URL Query Strings

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: fastloop_improved.py:603

Finding

Non-Atomic Daily Budget Enforcement Allows Concurrent Overspending

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The documented behavior does not fully match the described scope: the skill reportedly supports additional time windows, extra market discovery sources, and undeclared persistent local ledgers/state beyond the advertised strategy. For a trading skill handling API credentials and an optional wallet private key, hidden or underdocumented behaviors materially increase operational risk because reviewers may approve it under false assumptions about where data is sent, what gets stored, and when trades can occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script enables real-money trading solely through a --live flag and immediately executes strategy logic without an interactive confirmation, explicit risk acknowledgment, or final pre-trade guard. In the context of an automated trading skill that can also pick up a wallet private key from the environment, this increases the chance of accidental live execution and financial loss from operator mistake, automation misconfiguration, or malicious invocation by another component.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares access to sensitive capabilities through behavior implied in the documentation—environment secrets, local file read/write, and network access—but does not scope or declare those permissions explicitly. In an agent ecosystem, this weakens least-privilege controls and informed review, increasing the chance that API keys, wallet material, or local state files are exposed or misused by an overprivileged runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script reads WALLET_PRIVATE_KEY from the environment to enable live trading, but the file does not include a docstring, comment, or warning explaining the sensitivity of this credential or the consequences of providing it. Accessing private keys is safety-critical because it changes the execution mode and can authorize real financial actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code embeds a hard-coded NOFX API credential directly in outbound requests, which exposes secret material to anyone with file access and makes unauthorized reuse trivial. In a trading skill, this also creates operational risk because the credential can be harvested, abused, revoked, or tied back to the operator, disrupting service and potentially incurring account-level consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fastloop_improved.py (reported line 387)May include surrounding context.

python

def fetch_binance_orderbook(asset="BTC", limit=100):
    url = f"https://api.binance.com/api/v3/depth?symbol={ASSET_SYMBOLS.get(asset, 'BTCUSDT')}&limit={limit}"
    res = _api_request(url)
    if not res or "bids" not in res: return None
    bids, asks = [[float(i[0]), float(i[1])] for i in res["bids"]], [[float(i[0]), float(i[1])] for i in res["asks"]]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · fastloop_improved.py (reported line 418)May include surrounding context.

python

def fetch_binance_orderbook(asset="BTC", limit=100):
    url = f"https://api.binance.com/api/v3/depth?symbol={ASSET_SYMBOLS.get(asset, 'BTCUSDT')}&limit={limit}"
    res = _api_request(url)
    if not res or "bids" not in res: return None
    bids, asks = [[float(i[0]), float(i[1])] for i in res["bids"]], [[float(i[0]), float(i[1])] for i in res["asks"]]

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

When no wallet key is present, the code logs SIMULATION (Dry Run: {live}), but live is passed directly from get_client(live=not dry_run), so a dry run corresponds to live=False, not live=True. This comment/logging intent is actively misleading about whether execution is a dry run versus live client mode.

Content

No source excerpt is available for this finding.