ClawHub
Back to skill

Security audit

Polymarket FastLoop Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed automated trading skill, but it needs review because it can run recurring live trades and includes an embedded external API credential.

Install only if you intentionally want an automated trading bot. Use paper mode first, avoid enabling the provided live cron unless you have strict external spending limits and a way to disable it quickly, use narrowly scoped/revocable credentials, and treat the embedded NOFX credential and unpinned SDK as issues the publisher should fix before live use.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
clawhub.json:11
Finding

Persistent Scheduled Execution of Automated Live Trades

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
polymarket-simmer-fastloop.py:965
Finding

Hard-Coded NOFX API Credential Transmitted in URL Query Strings

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
clawhub.json:2
Finding

Unpinned Third-Party SDK Executes in a Credential-Bearing Trading Process

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented purpose materially understates the behavior: beyond signal filtering, the skill can execute live trades, read portfolio state, write persistent ledgers/caches, and call additional external services. This mismatch is dangerous because users or orchestrators may approve the skill under a narrower trust model than its actual authority, leading to financial loss, secret exposure, or unnoticed data exfiltration through undeclared integrations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The top-level documentation advertises multi-signal momentum trading, but the executable logic later uses contrarian mean-reversion. Because this is a trading skill with a --live mode, inaccurate documentation is not merely cosmetic; it can mislead users, reviewers, or orchestration systems into authorizing capital deployment under false assumptions about how decisions are made.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims to trade momentum fast markets, but the implemented decision logic explicitly does the opposite: when momentum is up it buys NO, and when momentum is down it buys YES. In a live-trading skill this semantic mismatch is dangerous because operators may enable real trading based on the documented strategy and unknowingly deploy the inverse risk profile, leading to systematic financial loss and unsafe automation behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares no explicit tool scope or permissions even though the documentation describes access to environment secrets, networked trading APIs, and local file reads/writes. In an agent setting, this weakens sandboxing and informed consent: a caller may invoke a skill that can place trades, persist state, and consume secrets without those capabilities being clearly declared or restricted.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · polymarket-simmer-fastloop.py (reported line 297)May include surrounding context.

python
dict with bid_depth, ask_depth, imbalance, or None on error
    """
    symbol = ASSET_SYMBOLS.get(asset, "BTCUSDT")
    url = f"https://api.binance.com/api/v3/depth?symbol={symbol}&limit={limit}"
    result = _api_request(url, timeout=5)
    if not result or isinstance(result, dict) and result.get("error"):
        return None

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · polymarket-simmer-fastloop.py (reported line 549)May include surrounding context.

python
dict with bid_depth, ask_depth, imbalance, or None on error
    """
    symbol = ASSET_SYMBOLS.get(asset, "BTCUSDT")
    url = f"https://api.binance.com/api/v3/depth?symbol={symbol}&limit={limit}"
    result = _api_request(url, timeout=5)
    if not result or isinstance(result, dict) and result.get("error"):
        return None

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

When run with --live, the script proceeds directly to execute real trades without an interactive confirmation or equivalent explicit acknowledgement step at the moment of order placement. In an automated trading context, this increases the chance of accidental real-money trades from mistyped commands, misunderstood defaults, or unreviewed configuration/state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description frames the skill as trading fast markets using momentum and order book filters, but the documentation states it also scans upcoming markets, caches market IDs to fast_markets_cache.json, and uses that cache to trade during an API blackout window. That persistence and blackout-window execution behavior is a material operational capability not reflected in the concise manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest says the skill trades with momentum and order book filters, but the documentation describes additional decision inputs including NOFX institutional netflow, a time-of-day filter, fee-accurate EV gating, and volatility-adjusted sizing. These are substantive parts of the strategy behavior, not just incidental implementation details.

Content

No source excerpt is available for this finding.