Security audit

Polymarket Trading Bot

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Polymarket trading skill, but it handles a wallet private key and can place live orders with weak safeguards and unsafe secret handling.

Review this carefully before installing. Use only a dedicated low-value wallet, avoid enabling autonomous mode, do not run config commands that print secrets, and treat any trade command as a real financial action. The skill should add secret redaction, safer key storage, pinned dependencies, dry-run mode, strict order validation, and explicit per-trade limits before use with meaningful funds.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: configure.py:45
Finding: Wallet Private Key Exposed Through Process Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: cli.py:45
Finding: Arbitrary Configuration Reads Can Print the Wallet Private Key
Content: View full analysis
[--value ][/yellow]") ``` ### Technical Analysis The `config` command accepts any caller-supplied key name and prints the complete returned value. The setup flow stores the wallet private key under `POLYMARKET_KEY`, so invoking: ```bash poly config --key POLYMARKET_KEY ``` may print the complete private key. The setting path is also unsafe for secrets. When both `key` and `value` are supplied, the sensitive value is placed in the subprocess argument vector and then repeated in terminal output: ```python console.print(f"[green]✔ Set {key} = {value}[/green]") ` ...[truncated 1409 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Dependencies Create a Mutable Supply-Chain Execution Path
Content: View full analysis
=61.0", "wheel"] ``` As a result, installations performed at different times can resolve different direct and transitive package versions. Pip may execute package build-backend or installation code, and installed runtime packages execute with the privileges of the user running the Skill. This risk is particularly significant for `py-clob-client` and related Web3 dependencies because the resulting code later receives `POLYMARKET_KEY` and constructs authenticated financial orders. The audit found no evidence that any named dependency is currently malicious; the vulnerability is the absence of reproducible version and integrity controls. ### Attack Path 1. A direct or transitive package version is compromised, maliciously replaced, or publishes an unsafe up ...[truncated 1023 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trade.py:47
Finding: Missing Order Validation Can Produce Unintended Financial Actions
Content: View full analysis
Remediation: View remediation
0`. - A configured maximum order value. 3. Query balance and current exposure before signing, then enforce the stated per-market bankroll limit in code. 4. Resolve and display the market question, outcome, token identifier, side, quantity, limit price, total cost, and maximum loss before submission. 5. Require explicit confirmation for each financial transaction by default. 6. If autonomous trading remains available, protect it with a separate policy engine that enforces allowlisted markets, per-order limits, daily loss limits, and an emergency stop. 7. Do not allow a general `--yes` flag to bypass policy checks; it should bypass only presentation-level confirmation after all hard limits pass. 8. Use decimal arithmetic for financial validation rather than binary floating-point where supported by the client. 9. Add tests for invalid sides, negative values, zero values, non-finite numbers, out-of-range prices, oversized orders, wrong token IDs, and policy-limit violations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (48)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The content allows authenticated balance access and live Polymarket order placement while claiming core capabilities such as analysis and opportunity identification that are not actually implemented in the skill file itself. That mismatch increases the chance of users authorizing a trading tool under the mistaken belief that robust analytical safeguards exist when the real behavior is primarily account access and execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The content allows authenticated balance access and live Polymarket order placement while claiming core capabilities such as analysis and opportunity identification that are not actually implemented in the skill file itself. That mismatch increases the chance of users authorizing a trading tool under the mistaken belief that robust analytical safeguards exist when the real behavior is primarily account access and execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The content allows authenticated balance access and live Polymarket order placement while claiming core capabilities such as analysis and opportunity identification that are not actually implemented in the skill file itself. That mismatch increases the chance of users authorizing a trading tool under the mistaken belief that robust analytical safeguards exist when the real behavior is primarily account access and execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The content allows authenticated balance access and live Polymarket order placement while claiming core capabilities such as analysis and opportunity identification that are not actually implemented in the skill file itself. That mismatch increases the chance of users authorizing a trading tool under the mistaken belief that robust analytical safeguards exist when the real behavior is primarily account access and execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly mentions executing trades 'autonomously if configured' but does not present a strong, up-front warning that these are real-money actions with financial loss potential. In a trading context, unclear disclosure of autonomous real-asset execution is especially dangerous because users may enable it without appreciating that the agent can place live orders using their credentials.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using shell=True expands the attack surface because the shell interprets the command string and environment, enabling injection and unexpected behavior if inputs ever become variable. Even though the present commands are hardcoded health checks, this pattern is especially unsafe in an agent skill where future maintenance could easily introduce attacker-influenced command content.
Content: Scanner excerpt · cli.py (reported line 95)May include surrounding context.
python
for name, cmd in checks: try: subprocess.run(cmd, shell=True, check=True, capture_output=True) console.print(f" [green]✔[/green] {name}") except: console.print(f" [red]✘[/red] {name} - NOT FOUND")

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file performs authenticated live trading by posting orders to Polymarket, which exceeds a stated analysis/research-only expectation and creates a capability mismatch. In an autonomous agent context, that mismatch is dangerous because users or orchestrators may invoke the skill assuming it is informational, while it can directly move funds and create irreversible market positions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The order placement path immediately creates and posts a live order with no confirmation prompt, preview, or secondary authorization. For an autonomous prediction-market agent, this makes accidental, prompt-influenced, or mis-parameterized trades easy to execute, potentially causing direct financial loss and unwanted exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly advertises trading functionality for an autonomous prediction market agent but provides no warning that commands may trigger financial actions, consume funds, or interact with external systems. In this context, missing safety and authorization guidance can mislead users into running commands without understanding the potential monetary and operational consequences.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises shell, network, and environment-dependent behavior but does not declare any explicit tool scope or allowed-tools restrictions. That creates an overbroad execution surface where an agent may invoke powerful capabilities implicitly, reducing user visibility and policy enforcement around network access, shell execution, and secret handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is broad enough to match generic trading, research, or market-analysis requests, making accidental selection more likely. In this context, accidental activation is more dangerous because the skill also exposes operational capabilities related to authenticated market interaction and automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill defines broad activation behavior such as responding to generic requests like analyzing Polymarket opportunities, which can overlap with ordinary research or finance prompts. Overbroad triggers increase the chance of unintended invocation of a high-risk skill that can access balances, set cron jobs, or prepare trades in contexts where the user did not clearly request execution-oriented assistance.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: The skill instructs the agent to create cron jobs for ongoing monitoring, which introduces persistence beyond the current session. Persistent scheduled behavior can continue accessing market data or prompting action later, and in a trading-related context this expands the risk of unintended automation, surprise notifications, or future actions tied to sensitive financial workflows.
Content: Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.
md
| "What's my balance?" | Run `poly balance` | | "Any crypto opportunities?" | `poly markets "crypto"` + research + recommend | | "News on [topic]" | Web search + find related markets + analyze | | "Set alert for [market]" | Create cron job to monitor | | "What happened to [market]?" | Check resolution, explain outcome | | "How much should I bet?" | Calculate Kelly Criterion based on edge and bankroll |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest uses Chinese for the user-facing name and description, which indicates a fixed language choice in natural-language metadata. The file provides no opt-in, alternative locale, or explanation that this skill is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill analyzes markets, researches news, and identifies trading opportunities, suggesting autonomous analytical behavior. In this file, most implemented commands are for local configuration, health checks, manual buy/sell execution, and toggling config flags, while the advertised analysis capability is only a printed instruction to ask another agent rather than actual analysis logic.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · cli.py (reported line 42)May include surrounding context.
python
""" script_dir = os.path.dirname(os.path.abspath(__file__)) setup_script = os.path.join(script_dir, "configure.py") subprocess.run([sys.executable, setup_script]) @app.command(rich_help_panel="Setup")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · cli.py (reported line 61)May include surrounding context.
python
# Set config cmd = ["clawdbot", "config", "set", f"skills.entries.polymarket-agent.env.{key}", value] try: subprocess.run(cmd, check=True) console.print(f"[green]✔ Set {key} = {value}[/green]") except Exception as e: console.print(f"[red]✘ Failed: {e}[/red]")

Tainted flow: 'cmd' from os.getenv (line 67, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · cli.py (reported line 61)May include surrounding context.
python
# Set config cmd = ["clawdbot", "config", "set", f"skills.entries.polymarket-agent.env.{key}", value] try: subprocess.run(cmd, check=True) console.print(f"[green]✔ Set {key} = {value}[/green]") except Exception as e: console.print(f"[red]✘ Failed: {e}[/red]")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · cli.py (reported line 69)May include surrounding context.
python
# Get config cmd = ["clawdbot", "config", "get", f"skills.entries.polymarket-agent.env.{key}"] try: result = subprocess.run(cmd, capture_output=True, text=True) console.print(f"[cyan]{key}[/cyan] = {result.stdout.strip()}") except Exception as e: console.print(f"[red]✘ Failed: {e}[/red]")

Tainted flow: 'cmd' from os.getenv (line 67, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · cli.py (reported line 69)May include surrounding context.
python
# Get config cmd = ["clawdbot", "config", "get", f"skills.entries.polymarket-agent.env.{key}"] try: result = subprocess.run(cmd, capture_output=True, text=True) console.print(f"[cyan]{key}[/cyan] = {result.stdout.strip()}") except Exception as e: console.print(f"[red]✘ Failed: {e}[/red]")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 97% confidence
Finding: This code uses subprocess.run with shell=True, which is inherently risky because it delegates parsing to the shell. In the current code the commands are hardcoded dependency checks, so immediate exploitability is limited, but future modification or accidental user influence could turn this into command injection or unexpected shell execution.
Content: Scanner excerpt · cli.py (reported line 95)May include surrounding context.
python
for name, cmd in checks: try: subprocess.run(cmd, shell=True, check=True, capture_output=True) console.print(f" [green]✔[/green] {name}") except: console.print(f" [red]✘[/red] {name} - NOT FOUND")

Tainted flow: 'cmd' from os.getenv (line 67, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · cli.py (reported line 95)May include surrounding context.
python
for name, cmd in checks: try: subprocess.run(cmd, shell=True, check=True, capture_output=True) console.print(f" [green]✔[/green] {name}") except: console.print(f" [red]✘[/red] {name} - NOT FOUND")

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · cli.py (reported line 159)May include surrounding context.
python
token_id: str = typer.Argument(..., help="Token ID to buy"), price: float = typer.Argument(..., help="Limit price (0.01 - 0.99)"), size: float = typer.Argument(..., help="Amount to buy"), confirm: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"), ): """ 💰 **Place a BUY order** on a market outcome.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · cli.py (reported line 179)May include surrounding context.
python
token_id: str = typer.Argument(..., help="Token ID to buy"), price: float = typer.Argument(..., help="Limit price (0.01 - 0.99)"), size: float = typer.Argument(..., help="Amount to buy"), confirm: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"), ): """ 💰 **Place a BUY order** on a market outcome.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · cli.py (reported line 171)May include surrounding context.
python
script_dir = os.path.dirname(os.path.abspath(__file__)) trade_script = os.path.join(script_dir, "trade.py") subprocess.run([sys.executable, trade_script, token_id, "BUY", str(price), str(size)]) @app.command(rich_help_panel="Trading")

Static analysis

No suspicious patterns detected.