Polymarket FastLoop Trader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:31 AM UTC
• Version: 1.0.10

Overview

This is a disclosed automated trading skill, but it needs review because it can run recurring live trades and includes an embedded external API credential.

Install only if you intentionally want an automated trading bot. Use paper mode first, avoid enabling the provided live cron unless you have strict external spending limits and a way to disable it quickly, use narrowly scoped/revocable credentials, and treat the embedded NOFX credential and unpinned SDK as issues the publisher should fix before live use.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: clawhub.json:11
• Finding: Persistent Scheduled Execution of Automated Live Trades<![CDATA[ ## Vulnerability Details **File Location**: `clawhub.json:11-15`; `SKILL.md:81-95` **Vulnerability Type**: Persistent scheduled task with live financial authority **Risk Level**: High ### Vulnerable Code `clawhub.json:11-15`: ```json "cron": "*/5 * * * *", "automaton": { "managed": true, "entrypoint": "polymarket-simmer-fastloop.py" } ``` `SKILL.md:81-95`: ```bash openclaw cron add \ --name "Simmer FastLoop" \ --cron "*/5 * * * *" \ --tz "UTC" \ --session isolated \ --message "Run: cd /path/to/skill && python polymarket-simmer-fastloop.py --live --quiet. Show output summary." \ --announce ``` ```text */5 * * * * cd /path/to/skill && python polymarket-simmer-fastloop.py --live --quiet ``` ### Technical Analysis The Skill declares managed cron execution every five minutes and documents installation of a cross-session scheduled task that explicitly invokes the trader with `--live`. When `TRADING_VENUE` is configured for Polymarket and suitable wallet credentials are available to the SDK, this grants the scheduled process recurring authority to submit real financial trades. Periodic execution is related to the declared fast-market trading functionality, but persistent live trading is not necessary for a one-shot invocation. It exceeds the safer minimum privilege because execution continues after the initiating session has ended and no longer requires contemporaneous user approval. The script includes daily and per-position limits, but these are application-level controls stored in mutable configuration and local state. They do not eliminate the persistence risk or guarantee that a compromised dependency, modified configuration, duplicate scheduler, or implementation defect cannot misuse the process's trading authority. ### Attack Path 1. A user follows the documented cron setup, or the platform processes the `cron` and managed automaton metadata. 2. A scheduled task is registered to execute the Skill every five minutes. 3. The ...[truncated 1003 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the automatic `cron` field and managed recurring-execution metadata from the default package. 2. Replace the documented `--live` cron examples with paper-mode examples. 3. Require a separate, explicit opt-in setting before scheduled live trading can be enabled. 4. Require interactive confirmation or a short-lived authorization token for each live execution. 5. Use narrowly scoped trading credentials with strict venue-side daily, per-order, and aggregate exposure limits. 6. Ensure scheduled jobs run in a restricted environment containing only the credentials required for the selected venue. 7. Document exact commands for listing, disabling, and deleting installed cron jobs. 8. Add a kill switch and expiration time so scheduled live trading automatically stops after a user-defined period. 9. Prevent overlapping scheduled runs by using an execution lock. 10. Record tamper-evident audit logs and notify the user whenever a live order is submitted. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: polymarket-simmer-fastloop.py:965
• Finding: Hard-Coded NOFX API Credential Transmitted in URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `polymarket-simmer-fastloop.py:965-968` **Vulnerability Type**: Embedded credential and insecure credential transport pattern **Risk Level**: Medium ### Vulnerable Code ```python # NOFX Macro Check try: nofx_url = "https://nofxos.ai/api/netflow/top-ranking?auth=cm_568c67eae410d912c54c&type=institution&duration=1h" nofx_24_url = "https://nofxos.ai/api/netflow/top-ranking?auth=cm_568c67eae410d912c54c&type=institution&duration=24h" res1 = _api_request(nofx_url, timeout=5) res24 = _api_request(nofx_24_url, timeout=5) ``` ### Technical Analysis A reusable authentication value is embedded directly in distributed source code. Anyone with access to the package can extract and attempt to reuse it. The credential is also placed in the query string instead of an authorization header. Although the request uses HTTPS, query strings can still be retained by application logs, reverse proxies, monitoring systems, exception telemetry, network security products, and server access logs. HTTPS protects the request in transit but does not prevent endpoint or infrastructure logging. The NOFX requests occur during normal strategy execution after a momentum signal is selected. The integration is not controlled by a documented opt-in setting, so users acquire this additional external dependency even if they only intended to use the documented Binance and Polymarket data sources. ### Attack Path 1. An attacker downloads or inspects the publicly distributed Skill source. 2. The attacker extracts `cm_568c67eae410d912c54c` from either hard-coded URL. 3. The attacker sends requests to the NOFX API using the exposed authentication value. 4. Alternatively, an operator, proxy, or telemetry system records the full request URL during normal execution. 5. A party with access to those logs obtains and reuses the credential. 6. The exposed credential may then be used until it is revoked or expires. ### Impact Assessment ...[truncated 552 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed credential immediately. 2. Remove all authentication values from source code and repository history. 3. Require users to supply their own NOFX credential through an environment variable or approved secret manager. 4. Send credentials through an `Authorization` header rather than a URL query parameter, if supported by the service. 5. Make the NOFX integration disabled by default and expose a documented configuration flag. 6. Redact query strings and authorization headers from application, proxy, and telemetry logs. 7. Scope the replacement credential to read-only access and the minimum endpoints required. 8. Add secret-scanning checks to CI and release workflows. 9. Fail safely when the optional NOFX credential is unavailable instead of silently relying on a shared embedded credential. ]]>

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:2
• Finding: Unpinned Third-Party SDK Executes in a Credential-Bearing Trading Process<![CDATA[ ## Vulnerability Details **File Location**: `clawhub.json:2-5`; `SKILL.md:59`; `polymarket-simmer-fastloop.py:96,201-213` **Vulnerability Type**: Unpinned dependency in a high-impact execution context **Risk Level**: Medium ### Vulnerable Code `clawhub.json:2-5`: ```json "requires": { "pip": [ "simmer-sdk" ], ``` `SKILL.md:59`: ```bash pip install simmer-sdk ``` `polymarket-simmer-fastloop.py:96`: ```python from simmer_sdk.skill import load_config, update_config, get_config_path ``` `polymarket-simmer-fastloop.py:201-213`: ```python def get_client(live=True): global _client if _client is None: try: from simmer_sdk import SimmerClient except ImportError: print("Error: simmer-sdk not installed. Run: pip install simmer-sdk") sys.exit(1) api_key = os.environ.get("SIMMER_API_KEY") if not api_key: print("Error: SIMMER_API_KEY environment variable not set") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "simmer") _client = SimmerClient(api_key=api_key, venue=venue, live=live) return _client ``` ### Technical Analysis The Skill installs `simmer-sdk` without an exact version constraint or integrity hash. Consequently, installation results can change after the Skill itself has been reviewed. A future compromised, malicious, or incompatible SDK release could execute code at import time within the Skill process. The exposure is elevated because the dependency is imported at module scope and later receives the Simmer API key, selected trading venue, and live-trading state. Python dependencies execute with the permissions of the current process and can ordinarily inspect environment variables, access user-readable files, make network requests, and modify runtime behavior. The audit did not establish that the current `simmer-sdk` package is malicious. The vulnerability is the absence of reproducible dependency controls in ...[truncated 1495 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `simmer-sdk` to a specific audited version using an exact constraint. 2. Generate and enforce cryptographic package hashes, such as with a hash-locked requirements file. 3. Commit a reproducible lock file and review dependency updates before release. 4. Verify the package publisher, source repository, signatures, and release provenance. 5. Install dependencies only from an explicitly configured trusted index. 6. Run the Skill in an isolated virtual environment or container under a dedicated unprivileged account. 7. Limit the process environment to only the secrets required for the selected operating mode. 8. Use narrowly scoped and revocable API credentials. 9. Add software-composition analysis and package-integrity verification to CI. 10. Test dependency upgrades in paper mode before permitting live trading. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose materially understates the behavior: beyond signal filtering, the skill can execute live trades, read portfolio state, write persistent ledgers/caches, and call additional external services. This mismatch is dangerous because users or orchestrators may approve the skill under a narrower trust model than its actual authority, leading to financial loss, secret exposure, or unnoticed data exfiltration through undeclared integrations.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The top-level documentation advertises multi-signal momentum trading, but the executable logic later uses contrarian mean-reversion. Because this is a trading skill with a `--live` mode, inaccurate documentation is not merely cosmetic; it can mislead users, reviewers, or orchestration systems into authorizing capital deployment under false assumptions about how decisions are made.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to trade momentum fast markets, but the implemented decision logic explicitly does the opposite: when momentum is up it buys NO, and when momentum is down it buys YES. In a live-trading skill this semantic mismatch is dangerous because operators may enable real trading based on the documented strategy and unknowingly deploy the inverse risk profile, leading to systematic financial loss and unsafe automation behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit tool scope or permissions even though the documentation describes access to environment secrets, networked trading APIs, and local file reads/writes. In an agent setting, this weakens sandboxing and informed consent: a caller may invoke a skill that can place trades, persist state, and consume secrets without those capabilities being clearly declared or restricted.

External Transmission

Medium

• Category: Data Exfiltration

Content

dict with bid_depth, ask_depth, imbalance, or None on error
    """
    symbol = ASSET_SYMBOLS.get(asset, "BTCUSDT")
    url = f"https://api.binance.com/api/v3/depth?symbol={symbol}&limit={limit}"
    result = _api_request(url, timeout=5)
    if not result or isinstance(result, dict) and result.get("error"):
        return None

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

dict with bid_depth, ask_depth, imbalance, or None on error
    """
    symbol = ASSET_SYMBOLS.get(asset, "BTCUSDT")
    url = f"https://api.binance.com/api/v3/depth?symbol={symbol}&limit={limit}"
    result = _api_request(url, timeout=5)
    if not result or isinstance(result, dict) and result.get("error"):
        return None

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: When run with `--live`, the script proceeds directly to execute real trades without an interactive confirmation or equivalent explicit acknowledgement step at the moment of order placement. In an automated trading context, this increases the chance of accidental real-money trades from mistyped commands, misunderstood defaults, or unreviewed configuration/state.

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The manifest description frames the skill as trading fast markets using momentum and order book filters, but the documentation states it also scans upcoming markets, caches market IDs to `fast_markets_cache.json`, and uses that cache to trade during an API blackout window. That persistence and blackout-window execution behavior is a material operational capability not reflected in the concise manifest description.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The manifest says the skill trades with momentum and order book filters, but the documentation describes additional decision inputs including NOFX institutional netflow, a time-of-day filter, fee-accurate EV gating, and volatility-adjusted sizing. These are substantive parts of the strategy behavior, not just incidental implementation details.

Static analysis

No suspicious patterns detected.