Mia Polymarket Trader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

This skill is for automated real-money Polymarket trading and asks users to expose a wallet private key to an unspecified command-line tool without enough safeguards.

Review this carefully before installing. Use only a dedicated low-value wallet, verify the exact mia-polymarket executable and source, avoid exposing a main wallet private key, and require explicit confirmation and hard value limits before any live trade.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Raw Wallet Private Key Exposed to an Unverifiable Command-Line Executable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26
Vulnerability Type: Sensitive credential exposure through process environment
Risk Level: High

Vulnerable Code

bash

export POLYMARKET_API_KEY="your-key"
export POLYMARKET_PRIVATE_KEY="your-wallet-key"
mia-polymarket analyze --market "tech-ai"
mia-polymarket trade --market-id "xxx" --position "yes" --amount 10

Technical Analysis

The setup instructions require users to export a raw wallet private key into an environment variable before executing mia-polymarket. Environment variables are ambient credentials inherited by child processes, so the invoked executable receives unrestricted access to POLYMARKET_PRIVATE_KEY.

The audited package contains no implementation of mia-polymarket, installation instructions, pinned package version, integrity hash, trusted source, or mechanism for validating the executable selected through the user's command search path. Consequently, users cannot audit how the private key is stored, used, or transmitted. A malicious, substituted, or compromised executable with the expected name could read and disclose the key.

The documented portfolio limit, stop-loss, and reporting controls are descriptive only. No code in the project enforces these controls or restricts the transactions that can be signed using the exposed key.

Attack Path

1. A user installs or otherwise obtains an untrusted executable named mia-polymarket, or an attacker places a spoofed executable earlier in the user's command search path.
2. Following SKILL.md, the user exports the API key and raw wallet private key into the shell environment.
3. The user invokes mia-polymarket analyze or mia-polymarket trade.
4. The operating system passes the exported credentials to the selected executable as part of its inherited environment.
5. The executable reads POLYMARKET_PRIVATE_KEY and may transmit it to an attacker or use it t ...[truncated 873 chars]

Remediation

View remediation

Remediation Suggestions

• Do not require users to expose raw wallet private keys through environment variables.
• Use a hardware wallet, isolated signing service, operating-system credential store, or wallet provider that supports scoped transaction signing.
• Require explicit user confirmation that displays the destination contract, market, position, amount, token allowance, fees, and maximum loss before signing.
• Use a dedicated low-value trading wallet with minimal balances and narrowly scoped token approvals.
• Publish the complete auditable implementation of mia-polymarket, including its credential-handling and transaction-signing logic.
• Provide a trusted installation source, cryptographic checksums or signatures, and pinned versions. Instruct users to validate the resolved executable path and integrity before supplying credentials.
• Enforce portfolio limits, daily loss limits, stop-loss behavior, market allowlists, and transaction-value caps in code rather than relying on documentation.
• Ensure secrets are never logged, included in error reports, passed as command-line arguments, or transmitted to analytics and telemetry services.
• Support credential revocation and document an incident-response procedure for rotating the API key, revoking token approvals, and moving assets if a wallet key is exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises autonomous market analysis and automated trade execution for a real-money prediction market, but it does not clearly warn users that it may place financially consequential trades using wallet credentials. In this context, omission of prominent financial-risk and real-money transaction warnings can mislead users about the consequences of enabling the skill, increasing the chance of unintended loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.