Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Polymarket public-data lookup tool with no credentials, persistence, or hidden local system changes.
Before installing, users should understand that the skill makes outbound requests to Polymarket's public API for market data. It does not require authentication or appear to read local private data, but tighter permission metadata and narrower trigger wording would improve transparency.
The skill performs network access to a public API but does not declare any tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: callers and the hosting agent may invoke a network-capable skill without explicit policy boundaries, making review, containment, and least-privilege enforcement harder.
The description includes broad invocation language such as use for questions about prediction markets, betting odds, market prices, event probabilities, or when the user asks about Polymarket data. Overly broad trigger text can cause the agent to select this skill in more situations than necessary, increasing unnecessary network calls and the chance of exposing user prompts or context to an external service.
No suspicious patterns detected.
