ClawHub
Back to skill

Security audit

Polymarket World Cup Player Goal Value

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent with its trading purpose, but it needs review because it can place live prediction-market orders and includes under-disclosed high-impact safety bypasses.

Review before installing. Use only a limited Simmer API key, start with `--venue sim`, avoid `--live` and `--no-safeguards` unless you intentionally accept real-money trading risk, and be aware that the packaged client helper bypasses a Simmer entrypoint integrity check.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers={"Authorization": f"Bearer {key}", "Accept": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            data = json.loads(r.read().decode())
    except Exception:
        return []
Confidence
72% confidence
Finding
The skill reads SIMMER_API_KEY from the environment and transmits it in an Authorization header to an external HTTPS endpoint. Although this is expected for authenticated API access and not obviously malicious, environment-derived secrets are being sent over the network, which increases exposure if the endpoint, DNS, proxy configuration, or TLS trust path is compromised. In a trading skill with live-order capability, credential misuse could affect account data and trading actions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises execution that clearly requires environment access, filesystem reads/writes, network access, and shell execution, but it does not declare those permissions. Undeclared capabilities reduce user visibility and policy enforcement, making it easier for the skill to fetch external data, manipulate local files, or execute commands without informed approval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The skill description understates and partially misrepresents actual behavior by omitting dataset rebuilding from external sources, account/position inspection, venue support beyond Polymarket, and execution restrictions tied to World Cup windows. That mismatch can mislead users about what the skill will do, what external systems it touches, and what operational risk they are accepting.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill metadata and description frame this as a Polymarket-specific strategy, but the code permits trading on sim and Kalshi venues via a command-line flag. That scope mismatch can cause operators or higher-level agents to invoke the skill under incorrect assumptions, leading to unintended orders on a different venue or account context.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The market classification logic and expected-match inference intentionally support season, single-match, and generic tournament props, which extends beyond the advertised World Cup player-goal scope. In an automated trading context, scope drift is dangerous because it can cause the skill to act on markets the operator did not intend to authorize.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script is wired to Simmer account endpoints and requires a Simmer API key even though the skill is described as trading Polymarket markets. That scope mismatch is dangerous because users may be induced to provide credentials for an unrelated third-party service, increasing the risk of credential misuse, confusion, or unauthorized account access under false pretenses.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation includes a command that enables live Polymarket trading, but it does not provide a prominent warning that this places real-money orders. In a trading skill, that omission is especially dangerous because a user can move from simulation to financially binding execution with a small flag change.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
print(f"- {label}: {ctx.name} — {ctx.detail} — score {ctx.score}")
    print()

    env = os.environ.copy()
    env["TRADING_VENUE"] = args.venue
    env.setdefault("SIMMER_WCPGV_PLAYER_DATA_FILE", "data/wc_players_filtered.csv")
    env.setdefault("SIMMER_WCPGV_MIN_PLAYER_MINUTES", "300")
Confidence
77% confidence
Finding
Copying the full parent environment into child processes can unintentionally propagate secrets such as API keys, credentials, and tokens to subordinate scripts that may not need them. In this skill context, the runner launches multiple helper scripts and also performs network-driven trading-related operations, so broad environment inheritance increases the blast radius if a child script logs, leaks, or misuses inherited secrets.

External Transmission

Medium
Category
Data Exfiltration
Content
"limit": max(1, min(limit, 1000)),
        }
    )
    url = f"https://api.simmer.markets/api/sdk/markets?{params}"
    req = urllib.request.Request(
        url,
        headers={"Authorization": f"Bearer {key}", "Accept": "application/json"},
Confidence
78% confidence
Finding
The skill makes direct outbound network requests to api.simmer.markets, including authenticated market-search traffic. External transmission is expected for a trading integration, but it still expands the trust boundary and can expose account metadata, search behavior, or credentials if transport or endpoint trust is subverted.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `cooldown_hours`
- `max_trades_per_run`
- `daily_budget_usd`
- optional context safeguards (disable with `--no-safeguards`)
Confidence
89% confidence
Finding
The skill exposes a flag to disable context safeguards, which weakens built-in risk controls intended to prevent unsafe or low-context trading decisions. In an automated trading context, allowing easy bypass of safeguards can increase the chance of executing poor or unintended trades, especially when combined with live mode.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
ap.add_argument("--live", action="store_true", help="Place real orders")
    ap.add_argument("--venue", choices=VENUE_CHOICES, default="polymarket", help="Trading venue")
    ap.add_argument("--positions", action="store_true", help="Show current positions and exit")
    ap.add_argument("--no-safeguards", action="store_true", help="Disable context safeguards")
    ap.add_argument("--quiet", action="store_true", help="Quiet output")
    ap.add_argument("--config", action="store_true", help="Print current config")
    ap.add_argument("--set", action="append", default=[], help="Update config key=value")
Confidence
93% confidence
Finding
The --no-safeguards flag disables market-context checks that block resolved markets and severe discipline warnings before trading. In a live trading skill, exposing a one-flag bypass for safety controls materially increases the chance of erroneous or policy-violating orders, especially if invoked by another agent or automation layer without strong operator review.

Static analysis

No suspicious patterns detected.