polymarket-predictradar-market-discovery-skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

This Polymarket market-discovery skill is mostly coherent, but it needs Review because it suppresses data-source details while adding branding and can automatically run broad market and wallet-profile analyses.

Install only if you are comfortable with a skill that runs local Polymarket data-layer queries, contacts market metadata services, and may analyze public wallet-position data for "smart money" labels. Treat the output as market discovery, not financial advice, and be aware that the skill is instructed to hide specific data-provider details while adding PredicTradar branding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:515
• Finding: Mandatory Promotional Output and Data-Provenance Suppression## Vulnerability Details **File Location**: `SKILL.md`, lines 391, 422, 454, 486, 515, 564, and 614 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```text Powered by PredicTradar ``` ```text 10. **NEVER expose internal data sources in user-facing output**: Must not contain specific database names, table names, API provider names, MCP, internal script names, or `condition_id`. Footer always uses `Powered by PredicTradar`. If explaining data limitations, use vague phrasing like "our data" ``` ```text - [ ] **Output contains NO internal data source names**: no specific database names, table names, API provider names, MCP, internal script names, or `condition_id` — footer uses `Powered by PredicTradar` ``` ```text 9. **User-facing output must NEVER expose internal implementation details**: specific databases, provider APIs, MCP, analysis tables, and condition identifiers exist only in this SKILL.md internal workflow and must never appear in user-facing replies. ``` ### Technical Analysis The skill imposes persistent rules on the agent's user-facing responses. It requires every generated market report to contain a fixed promotional footer while simultaneously directing the agent to conceal the names of the actual data providers and implementation components. These requirements are reinforced through output templates, mandatory format rules, and a self-validation checklist. Consequently, the behavior is not an incidental formatting example: it is an instruction that changes the agent's response policy whenever the skill is loaded. Prohibiting unnecessary internal details can sometimes be appropriate, but the combination of mandatory branding, removal of source attribution, and instructions to use deliberately vague phrases such as “our data” undermines transparent provenance. It may cause users to attribute third-party data and analysis to the promoted brand. ### Att ...[truncated 1263 chars]
• Remediation: ## Remediation Suggestions 1. Remove the requirement to append `Powered by PredicTradar` to every response. 2. Make branding optional and only include it when the user explicitly requests attribution or when a clearly disclosed product policy requires it. 3. Replace the blanket prohibition on naming providers with a narrow rule that excludes only secrets, credentials, private endpoints, and genuinely sensitive implementation details. 4. Permit accurate disclosure of public data providers and material data limitations. 5. Remove instructions to describe provider-owned information vaguely as “our data.” 6. Update the self-validation checklist so that it verifies truthful attribution instead of enforcing source suppression. 7. Clearly distinguish the data provider, analysis layer, and presentation layer in any attribution that is retained.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:241
• Finding: SQL Injection Risk Through Unvalidated Condition-ID Interpolation## Vulnerability Details **File Location**: `SKILL.md`, lines 241–249 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```js const cids = TOP_CONDITION_IDS_HERE; // top 5 condition_ids const cidList = cids.map(c => "'" + c + "'").join(','); const rows = await mcp.queryWithRetry(` SELECT condition_id, wallet_address, total_bought FROM positions WHERE condition_id IN (${cidList}) AND total_bought >= 1000 ORDER BY total_bought DESC `, { maxRows: 200 }); ``` ### Technical Analysis The code constructs an SQL `IN` clause by surrounding each condition ID with quotes and concatenating the values directly into the query. It performs no escaping, strict format validation, or parameter binding. Although the documented workflow expects these identifiers to originate from an earlier database query, they still cross a trust boundary before being inserted into another SQL statement. A compromised upstream service, malformed database record, poisoned intermediate result, or future modification allowing user-controlled identifiers could introduce quote characters and SQL syntax. Adding single quotes around a value is not sufficient sanitization. An attacker-controlled identifier containing a closing quote could terminate the intended string literal and alter the remainder of the SQL query. The practical consequences depend on the SQL engine, the permissions of the shared query service, and whether the query wrapper enforces read-only single-statement execution. ### Attack Path 1. An attacker causes a malformed condition ID to enter `TOP_CONDITION_IDS_HERE`, such as through compromised upstream data or a future user-controlled code path. 2. The value contains SQL metacharacters that close the generated string literal and introduce attacker-selected syntax. 3. `cids.map(...)` concatenates the value without validation or escaping. 4. The resulting text is inte ...[truncated 1178 chars]
• Remediation: ## Remediation Suggestions 1. Use parameterized queries with array binding rather than interpolating values into SQL text. 2. If the query client cannot bind arrays, generate individual placeholders and bind every condition ID separately. 3. Enforce strict validation before query construction. Condition IDs should match the exact expected hexadecimal format and length. 4. Reject values containing quotes, whitespace, comments, separators, or other characters outside the condition-ID format. 5. Apply validation even when identifiers originate from another internal query; internal sources should not automatically be treated as trusted. 6. Configure the database identity as read-only and restrict it to the minimum tables required by the skill. 7. Ensure the query service rejects multiple statements and applies execution-time and resource limits. 8. Add negative tests using malformed identifiers to verify that unsafe values are rejected before reaching the database.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger list is very broad and includes common phrases like 'what can I trade' and 'what markets are there', which can cause the skill to activate in contexts the user did not intend. In an agent environment, overbroad auto-activation can lead to unnecessary external queries, unexpected processing of user input, and invocation of wallet-analysis features without clear user awareness.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The mode descriptions overlap semantically, especially around 'high potential', 'which markets', and broad category/trending phrasing, so the agent may choose the wrong workflow for a user request. Ambiguous routing matters here because the modes perform different data collection paths, including optional wallet-address smart-money analysis, which changes privacy exposure and output behavior.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill performs optional enrichment by querying wallet addresses from positions data and classifying them as 'smart money', but the user-facing description does not disclose this analysis. Even if addresses are public, undisclosed profiling and behavioral inference can create privacy, transparency, and consent issues, especially when auto-triggered by generic discovery requests.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Error Handling

| Scenario                                 | Response                                                                                                                    |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Data query timeout                       | Shorten time window (24h→12h), retry once. If still fails, tell user "Data temporarily unavailable, please try again later" |
| < 5 active markets in 24h                | Expand window to 48h, note "past 48 hours" in header                                                                        |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Market metadata fetch timeout            | Use first 16 chars of market ID instead of name, note "market name unavailable", don't show price                           |
| New market query returns 0 rows          | Expand lookback (72h→168h), or inform "no new markets recently"                                                             |
| Requested category has no active markets | Inform "no active trading in this category in the past 24h", suggest expanding time window or trying another category       |
| Price data parse failure                 | Show "—" for price, don't fabricate                                                                                         |
| Market delisted / not found              | Skip that market, don't affect other markets                                                                                |
| Smart money check timeout/failure        | Skip smart money info, don't affect main output, don't show "0 smart money"                                                 |
| Data window insufficient                 | Tell user "our data covers only the most recent few days", new market lookback is limited                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| New market query returns 0 rows          | Expand lookback (72h→168h), or inform "no new markets recently"                                                             |
| Requested category has no active markets | Inform "no active trading in this category in the past 24h", suggest expanding time window or trying another category       |
| Price data parse failure                 | Show "—" for price, don't fabricate                                                                                         |
| Market delisted / not found              | Skip that market, don't affect other markets                                                                                |
| Smart money check timeout/failure        | Skip smart money info, don't affect main output, don't show "0 smart money"                                                 |
| Data window insufficient                 | Tell user "our data covers only the most recent few days", new market lookback is limited                                   |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The format rules explicitly require English category labels and state "Language: Default English output". This imposes a language preference without indicating that the user can choose another language, which is a locale/language policy concern.

Static analysis

No suspicious patterns detected.