Prediction Market Arbitrage Api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

The skill is read-only and mostly matches its arbitrage purpose, but it includes under-disclosed wallet profiling commands that can send wallet addresses and related queries to AIsa.

Install only if you are comfortable giving the skill an AIsa API key and sending market queries to api.aisa.one. Avoid using the wallet, activity, positions, or P&L commands unless you intend to disclose that wallet identifier and analysis request to AIsa; the core arbitrage scanner does not appear to trade or connect wallets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: scripts/prediction_market_client.py:151

Finding

Undisclosed Transmission of Wallet Identifiers and Excessive Wallet-Profiling Capabilities

Content

View full analysis

Dict[str, Any]: """Get activity for a Polymarket wallet address.""" return self._request("/polymarket/activity", params={ "user": user, "market_slug": market_slug, "condition_id": condition_id, "start_time": start_time, "end_time": end_time, "limit": limit, "offset": offset, }) def polymarket_orders(self, market_slug: Optional[str] = None, condition_id: Optional[str] = None, token_id: Optional[str] = None, user: Optional[str] = None, start_time: Optional[int] = None, end_time: Optional[int] = None, limit: int = 100, offset: int = 0) -> Dict[str, Any]: """Get Polymarket trade history.""" return self._request("/polymarket/orders", params={ "market_slug": market_slug, "condition_id": condition_id, "token_id": token_id, "user": user, "start_time": start_time, "end_time": end_time, "limit": limit, "offset": offset, }) ``` ```python def polymarket_positions(self, wallet_address: str, limit: int = 100, pagination_key: Optional[str] = None) -> Dict[str, Any]: """Get Polymarket positions f ...[truncated 4675 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A description-behavior mismatch is security-relevant because users and orchestrators may invoke the skill expecting harmless read-only arbitrage scanning, while the underlying implementation reportedly includes undeclared wallet, activity, positions, or P&L inspection features. Hidden or undeclared financial-account visibility expands the data exposure surface and undermines informed consent, especially in a finance-related context where account-linked information can be sensitive.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares access to an environment variable and relies on outbound network access, but it does not explicitly scope or constrain those capabilities through a permissions or allowed-tools declaration. That creates an avoidable trust gap: consumers cannot easily tell what the skill is permitted to access, and future script changes could expand sensitive behavior without corresponding manifest restrictions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Overly broad trigger phrases can cause the skill to activate for ordinary discussions about sports betting, odds, or market inefficiencies that do not require this external API-backed financial tool. In this context, over-triggering is more dangerous because it may unnecessarily expose the API key, initiate unneeded network calls, or route users into a skill with broader-than-advertised capabilities.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbitrage_finder.py (reported line 43)May include surrounding context.

python

class AIsaClient:
    """Lightweight client for the AIsa prediction market API."""

    BASE_URL = "https://api.aisa.one/apis/v1"

    def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key or os.environ.get("AISA_API_KEY")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes wallet activity, orders, positions, wallet details, and P&L lookups for arbitrary Polymarket addresses, which materially exceeds a narrow sports-arbitrage scanning use case. Even if this data is public or API-exposed, bundling arbitrary address surveillance into an agent skill increases privacy and profiling risk and can enable unanticipated user tracking.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill transmits user-supplied query data, including potentially sensitive wallet addresses and trading-related lookups, to an external domain under third-party control. In an agent setting, external transmission is security-relevant because it expands the trust boundary and can expose user interests, addresses, or analysis targets to a service not described as first-party.

Content

Scanner excerpt · scripts/prediction_market_client.py (reported line 52)May include surrounding context.

python

class PredictionMarketClient:
    """Cross-Platform Prediction Market Data - AIsa API Client."""

    BASE_URL = "https://api.aisa.one/apis/v1"

    def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key or os.environ.get("AISA_API_KEY")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The request layer sends wallet addresses, market filters, and other query data to an external service without any explicit disclosure or consent mechanism in the code path. In the context of an agent skill, users may not realize that address-based lookups and activity queries are being transmitted to a third-party API, creating privacy and data-handling concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The client automatically reads AISA_API_KEY from the environment, which is a credential-sensitive operation covered by the warning requirement for code files. The current messages only state that the variable is required; they do not warn users that the skill consumes a secret from the environment for external API authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file makes outbound HTTP requests to api.aisa.one and sends user-supplied market identifiers and query parameters, authenticated with the user's AISA_API_KEY. While the module docstring describes the tool's purpose, there is no explicit disclosure in the CLI help or runtime messaging that user inputs and request metadata are transmitted to a third-party API.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest emphasizes scanning sports markets for cross-platform discrepancies, but the CLI exposes generic Polymarket and Kalshi market search, price, trade, candlestick, and orderbook retrieval without restricting scope to sports. This is broader market-data functionality than the stated sports arbitrage focus.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes a market-analysis skill and does not mention credential handling or environment access. While the API key is used only for authenticating expected outbound requests, environment-variable access is still an additional capability not disclosed in the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The client reads the AISA_API_KEY from the environment, which is a sensitive credential access pattern. While the code errors if the key is missing, it does not provide any user-facing warning or comment beyond basic configuration text that the skill will consume a secret from the environment and use it for outbound authentication.

Content

No source excerpt is available for this finding.