T06 · System Persistence
Error
- Location
clawhub.json:7- Finding
Unattended Scheduled Live Trading Creates Persistent Financial Side Effects
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Solana Onchain
Security checks for vulnerabilities and agentic risk
Overview
This trading skill can run live trades automatically on a schedule using a required API key, with under-disclosed risk controls.
Install only if you intentionally want recurring automated live trading. Use a narrowly scoped, revocable SIMMER_API_KEY with account-side spending limits, verify or disable the cron/--live automation, and prefer dry-run mode until the dependency pinning, live-trade confirmation, fail-closed safeguards, and cumulative loss limits are improved.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
strategy.py:353- Finding
Trading Safeguard Fails Open When Context Validation Is Unavailable
- Content
View full analysis
tuple[bool, str]: try: ctx = client._request("GET", f"/api/sdk/context/{market_id}") discipline = ctx.get("discipline", {}) if discipline.get("warning_level") == "severe": return False, "severe flip-flop" slippage = ctx.get("slippage", {}) if slippage: estimates = slippage.get("estimates", []) if estimates and estimates[0].get("slippage_pct", 0) > 0.15: return False, "high slippage" return True, "" except Exception: return True, "" # Don't block on context failure ``` The returned approval is consumed before live trading: ```python ok, reason = check_context(client, c["market_id"]) if not ok: log(f" ⛔ Skipped: {reason}") skip_reasons.append(reason) continue ``` A successful fail-open result permits the later call to `client.trade()`. ### Technical Analysis The context check is intended to reject markets with a severe discipline warning or estimated slippage above 15%. However, every exception is caught and converted into a successful authorization result. Exceptions may be caused by network failures, timeouts, service outages, malformed responses, unexpected response types, SDK errors, or incompatible API changes. Consequently, the absence of trustworthy risk data is treated as evidence that trading is safe. This is a fail-open control design. For a live financial operation, a failed prerequisite safety check should prevent execution rather than silently authorize it. ### Attack Path 1. The strategy identifies a candidate market during a live scheduled run. 2. The context API request fails or returns data that causes an exception. 3. The broad `except Exception` handler suppresses the fai ...[truncated 863 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
clawhub.json:3- Finding
Unpinned Third-Party SDK Executes In Process with Access to the Trading Credential
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description says 'No API keys required' and frames the skill as reading public Solana/Jupiter signals, but the skill also requires a Simmer API key and can execute authenticated trades. This mismatch can mislead users and automated policy systems about the true capabilities of the skill, increasing the chance of unintended secret exposure or real-money actions under incomplete consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest explicitly requires a SIMMER_API_KEY while the skill description claims that no API keys are required. This discrepancy is a supply-chain trust and transparency issue: users may install or run the skill under false assumptions and expose a sensitive credential to code they would not otherwise trust. In an agent/automation context, unnecessary secret collection increases the blast radius if the skill is compromised or behaves unexpectedly.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises network access, environment-variable use, and live trading behavior but does not declare any explicit tool scope or permissions. In an agent ecosystem, missing scope declarations weakens user visibility and policy enforcement, making it easier for a skill to access secrets or external services without clear consent boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage section presents a '--live' command for real trading without a prominent warning about financial loss, irreversible execution, or the need for explicit user confirmation. In a trading skill, this omission increases the risk of accidental live orders and makes the context more dangerous because the documented purpose is market execution, not just analysis.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and manifest emphasize that the skill operates from free public Solana/Jupiter data with 'No API keys required.' However, the actual trading path exits unless SIMMER_API_KEY is present and uses SimmerClient to place trades. While market data collection is keyless, the end-to-end skill behavior for live trading is not.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The docstring's usage example implies '--set max_position_usd=50' configures the run. In code, MAX_POSITION_USD, MAX_TRADES_PER_RUN, and SIGNAL_THRESHOLD are initialized at import time from the environment, and the --set handler mutates os.environ only later in main. As a result, the current process continues using the old already-cached values, contradicting the advertised behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Live mode can place real trades immediately when invoked with --live, with no secondary confirmation, no interactive acknowledgment, and no explicit high-visibility risk prompt. In a financial-trading skill, that increases the chance of accidental execution from user error, automation misuse, or misunderstood CLI invocation, causing direct monetary loss.
- Content