ClawHub
Back to skill

Security audit

Polymarket Autotrade

Security checks across malware telemetry and agentic risk

Overview

This Polymarket skill is not deceptive, but it needs Review because it can submit real trades using wallet credentials without a confirmation step.

Install only if you intentionally want an agent-accessible Polymarket trading tool. Use a dedicated limited-funds wallet, protect the credential files, avoid enabling broad automatic invocation for trading phrases, and prefer a version that requires explicit confirmation before every live order and uses pinned dependency versions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly requires sensitive environment variables, writes credential files locally, and performs network operations, yet it does not declare permissions. That creates a trust and review gap: users and the platform may not realize the skill can access secrets, persist API credentials, and contact external endpoints before enabling it.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trading triggers are broad phrases like 'Place a bet' or 'Long [market]' that can match ordinary conversation and may cause the agent to invoke a real-money trading skill unintentionally. In a financial context, accidental invocation can directly lead to unauthorized or unintended trades, making the ambiguity materially dangerous.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill places live market orders immediately after parsing CLI arguments, with no confirmation prompt, dry-run mode, price-impact check, or explicit acknowledgement that real funds are at risk. In an agent or automation context, a mistaken invocation, prompt injection, or parameter confusion can directly cause irreversible financial loss.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Polymarket Skill Dependencies
requests>=2.31.0
py-clob-client>=1.5.0
Confidence
96% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Polymarket Skill Dependencies
requests>=2.31.0
py-clob-client>=1.5.0
Confidence
96% confidence
Finding
py-clob-client>=1.5.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
requests

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low
Category
Supply Chain
Confidence
88% confidence
Finding
requests==2.31.0

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.